{"id":"CVE-2014-5021","aliases":["DSA-2983-1","EUVD-2014-4920","GHSA-c33g-h7g2-frf6","MGASA-2014-0322","UBUNTU-CVE-2014-5021"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in the Form API in Drupal 6.x before 6.32 and possibly 7...","description":"Cross-site scripting (XSS) vulnerability in the Form API in Drupal 6.x before 6.32 and possibly 7.x before 7.29 allows remote authenticated users with the \"administer taxonomy\" permission to inject arbitrary web script or HTML via an option group label.","severity":{"version":"2.0","score":2.1,"vector":"AV:N/AC:H/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01096,"percentile":0.65806,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2014-07-20T00:00:00Z","modified":"2026-06-17T00:10:56Z","affected":[{"source":"osv","ecosystem":"Debian:7","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.14-2+deb7u5"}]}],"versions":["7.14-2","7.14-2+deb7u1","7.14-2+deb7u1~bpo60+1","7.14-2+deb7u2","7.14-2+deb7u2~bpo60+1","7.14-2+deb7u3","7.14-2+deb7u4","7.14-2+deb7u4~bpo60+1"],"bundled":4},{"source":"osv","ecosystem":"Mageia:3","package":"drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.29-1.mga3"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:4","package":"drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.29-1.mga4"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.23-1","7.24-1","7.24-2","7.26-1","7.26-1ubuntu0.1","7.26-1ubuntu0.1+esm1","7.26-1ubuntu0.1+esm2","7.26-1ubuntu0.1+esm3"]}],"products":[{"vendor":"drupal","product":"drupal"}],"references":[{"url":"http://www.debian.org/security/2014/dsa-2983","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","report"]},{"url":"https://www.drupal.org/SA-CORE-2014-003","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-5021"},{"url":"https://github.com/advisories/GHSA-c33g-h7g2-frf6"},{"url":"https://advisories.mageia.org/MGASA-2014-0322.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13271","tags":["report"]},{"url":"https://drupal.org/SA-CORE-2014-002","tags":["web"]},{"url":"https://drupal.org/SA-CORE-2014-003","tags":["web"]},{"url":"https://drupal.org/drupal-7.27","tags":["web"]},{"url":"https://drupal.org/drupal-7.27-release-notes","tags":["web"]},{"url":"https://drupal.org/drupal-7.28","tags":["web"]},{"url":"https://drupal.org/drupal-7.28-release-notes","tags":["web"]},{"url":"https://drupal.org/drupal-7.29","tags":["web"]},{"url":"https://drupal.org/drupal-7.29-release-notes","tags":["web"]},{"url":"https://www.debian.org/security/2014/dsa-2913","tags":["web"]},{"url":"https://www.debian.org/security/2014/dsa-2983","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-5021","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-5021","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-5021","description":"Cross-site scripting (XSS) vulnerability in the Form API in Drupal 6.x before 6.32 and possibly 7.x before 7.29 allows remote authenticated users with the \"administer taxonomy\" permission to inject arbitrary web script or HTML via an option group label.","status":"published","published":"2014-07-22T14:00:00Z","modified":"2024-09-17T02:46:40.585Z","updated_at":"2026-11-02T14:33:41.889751Z"}],"euvd":[{"id":"EUVD-2014-4920","description":"Cross-site scripting (XSS) vulnerability in the Form API in Drupal 6.x before 6.32 and possibly 7.x before 7.29 allows remote authenticated users with the \"administer taxonomy\" permission to inject arbitrary web script or HTML via an option group label.","status":"published","published":"2014-07-22T14:00:00Z","modified":"2024-09-17T02:46:40Z","updated_at":"2026-11-03T00:28:37.764675Z"}],"ghsa":[{"id":"GHSA-c33g-h7g2-frf6","title":"Cross-site scripting (XSS) vulnerability in the Form API in Drupal 6.x before 6.32 and possibly 7...","description":"Cross-site scripting (XSS) vulnerability in the Form API in Drupal 6.x before 6.32 and possibly 7.x before 7.29 allows remote authenticated users with the \"administer taxonomy\" permission to inject arbitrary web script or HTML via an option group label.","status":"published","published":"2022-05-17T04:39:24Z","modified":"2023-01-28T05:02:16Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:43:44.921454Z"}],"nvd":[{"id":"CVE-2014-5021","description":"Cross-site scripting (XSS) vulnerability in the Form API in Drupal 6.x before 6.32 and possibly 7.x before 7.29 allows remote authenticated users with the \"administer taxonomy\" permission to inject arbitrary web script or HTML via an option group label.","status":"published","published":"2014-07-22T14:55:10.083Z","modified":"2026-06-17T00:10:56.183Z","cvss":[{"version":"2.0","score":2.1,"vector":"AV:N/AC:H/Au:S/C:N/I:P/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:54.827864Z"}],"osv":[{"id":"DSA-2983-1","title":"drupal7 - security update","status":"published","published":"2014-07-20T00:00:00Z","modified":"2026-03-09T01:18:06.733893Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0322","title":"Updated drupal packages fix security vulnerabilities","description":"An information disclosure vulnerability was discovered in Drupal before 7.27.\nWhen pages are cached for anonymous users, form state may leak between\nanonymous users. Sensitive or private information recorded for one anonymous\nuser could thus be disclosed to other users interacting with the same form at\nthe same time (CVE-2014-2983).\n\nMultiple security issues in Drupal before 7.29, including a denial of service\nissue, an access bypass issue in the File module, and multiple cross-site\nscripting issues (CVE-2014-5019, CVE-2014-5020, CVE-2014-5021, CVE-2014-5022).\n\nDrupal has been updated to version 7.29, fixing this and other bugs.\n","status":"published","published":"2014-08-07T17:01:33Z","modified":"2026-04-16T06:25:32.393736246Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"UBUNTU-CVE-2014-5021","description":"Cross-site scripting (XSS) vulnerability in the Form API in Drupal 6.x before 6.32 and possibly 7.x before 7.29 allows remote authenticated users with the \"administer taxonomy\" permission to inject arbitrary web script or HTML via an option group label.","status":"published","published":"2014-07-22T14:55:00Z","modified":"2025-09-08T16:43:12Z","updated_at":"2026-11-02T15:54:09.010095Z"}]}}