CVE-2013-2177

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2013-06-25 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in the Display Suite module 7.x-1.x before 7.x-1.7 and 7.x-2.x before 7.x-2.3 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via an entity bundle label.

Affected products

Kristof De Jaeger Display Suite: 7x-1.0, 7x-1.0-rc3, 7x-1.1, 7x-1.2, 7x-1.3, 7x-1.4 (+10)

References

http://osvdb.org/94234
http://seclists.org/fulldisclosure/2013/Jun/94
https://drupal.org/node/2017639
https://drupal.org/node/2017641
https://drupal.org/node/2017933
http://osvdb.org/94234
http://seclists.org/fulldisclosure/2013/Jun/94
https://drupal.org/node/2017639
https://drupal.org/node/2017641
https://drupal.org/node/2017933

Get alerted when CVE-2013-2177 or the next vulnerability affects your stack