CVE-2013-1887

Severity: low (CVSS 2.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.0% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-03-27 · updated 2026-06-16
Weakness: CWE-79

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Views module 7.x-3.x before 7.x-3.6 for Drupal allow remote authenticated users with certain permissions to inject arbitrary web script or HTML via certain view configuration fields.

Affected products

Views Project Views: 7.x-3.0, 7.x-3.0-alpha1, 7.x-3.0-beta1, 7.x-3.0-beta2, 7.x-3.0-beta3, 7.x-3.0-rc1 (+7)

References

http://drupal.org/node/1948354
http://drupal.org/node/1948358
http://drupalcode.org/project/views.git/commitdiff/ddf8181bd13f69ffbeeee14ae72168418785d7ac
http://packetstormsecurity.com/files/120892/Drupal-Views-7.x-Cross-Site-Scripting.html
http://seclists.org/fulldisclosure/2013/Mar/193
http://secunia.com/advisories/51540
http://www.openwall.com/lists/oss-security/2013/03/22/8
http://www.openwall.com/lists/oss-security/2013/03/25/4
http://www.osvdb.org/91576
http://www.securityfocus.com/bid/58621
http://drupal.org/node/1948354
http://drupal.org/node/1948358

Get alerted when CVE-2013-1887 or the next vulnerability affects your stack