CVE-2012-2708
Cross-site scripting (XSS) vulnerability in the _hosting_task_log_table function in modules...
Cross-site scripting (XSS) vulnerability in the _hosting_task_log_table function in modules/hosting/task/hosting_task.module in the Hostmaster (Aegir) module 6.x-1.x before 6.x-1.9 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a Drush log message in a provision task log.
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in the _hosting_task_log_table function in modules/hosting/task/hosting_task.module in the Hostmaster (Aegir) module 6.x-1.x before 6.x-1.9 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a Drush log message in a provision task log.
- Record
CVE-2012-2708- CVSS 2.0
- 2.1 Low
AV:N/AC:H/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in the _hosting_task_log_table function in modules/hosting/task/hosting_task.module in the Hostmaster (Aegir) module 6.x-1.x before 6.x-1.9 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a Drush log message in a provision task log.
- Record
CVE-2012-2708- Updated
- 2026-11-02
EUVDEUVD-2012-2688 No score
Cross-site scripting (XSS) vulnerability in the _hosting_task_log_table function in modules/hosting/task/hosting_task.module in the Hostmaster (Aegir) module 6.x-1.x before 6.x-1.9 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a Drush log message in a provision task log.
- Record
EUVD-2012-2688- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-4537-mgq5-cjx2 No score
Cross-site scripting (XSS) vulnerability in the _hosting_task_log_table function in modules...
Cross-site scripting (XSS) vulnerability in the _hosting_task_log_table function in modules/hosting/task/hosting_task.module in the Hostmaster (Aegir) module 6.x-1.x before 6.x-1.9 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via a Drush log message in a provision task log.
- Record
GHSA-4537-mgq5-cjx2- Weakness
- CWE-79
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2012-2708 is a low vulnerability (CVSS 2.1) in Antoine Beaupre Hostmaster, published June 27, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.60%, the 75th percentile. No source names a fixed version.
References
drupal.org/node/1585678
openwall.com/lists/oss-security/2012/06/14/3
community.aegirproject.org/1.9
securityfocus.com/bid/53588
drupalcode.org/project/hostmaster.git/commitdiff/9476561
exchange.xforce.ibmcloud.com/vulnerabilities/75714
nvd.nist.gov/vuln/detail/CVE-2012-2708
github.com/advisories/GHSA-4537-mgq5-cjx2