{"id":"CVE-2014-5022","aliases":["DSA-2983-1","EUVD-2014-4921","GHSA-j47j-5wh7-4gmm","MGASA-2014-0322","UBUNTU-CVE-2014-5022"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in the Ajax system in Drupal 7.x before 7.29 allows...","description":"Cross-site scripting (XSS) vulnerability in the Ajax system in Drupal 7.x before 7.29 allows remote attackers to inject arbitrary web script or HTML via vectors involving forms with an Ajax-enabled textfield and a file field.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.00995,"percentile":0.62891,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2014-07-20T00:00:00Z","modified":"2026-06-17T00:10:56Z","affected":[{"source":"osv","ecosystem":"Debian:7","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.14-2+deb7u5"}]}],"versions":["7.14-2","7.14-2+deb7u1","7.14-2+deb7u1~bpo60+1","7.14-2+deb7u2","7.14-2+deb7u2~bpo60+1","7.14-2+deb7u3","7.14-2+deb7u4","7.14-2+deb7u4~bpo60+1"],"bundled":4},{"source":"osv","ecosystem":"Mageia:3","package":"drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.29-1.mga3"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:4","package":"drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.29-1.mga4"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.23-1","7.24-1","7.24-2","7.26-1","7.26-1ubuntu0.1","7.26-1ubuntu0.1+esm1","7.26-1ubuntu0.1+esm2","7.26-1ubuntu0.1+esm3"]}],"products":[{"vendor":"drupal","product":"drupal"}],"references":[{"url":"http://www.debian.org/security/2014/dsa-2983","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","report"]},{"url":"https://www.drupal.org/SA-CORE-2014-003","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-5022"},{"url":"https://github.com/advisories/GHSA-j47j-5wh7-4gmm"},{"url":"https://advisories.mageia.org/MGASA-2014-0322.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13271","tags":["report"]},{"url":"https://drupal.org/SA-CORE-2014-002","tags":["web"]},{"url":"https://drupal.org/SA-CORE-2014-003","tags":["web"]},{"url":"https://drupal.org/drupal-7.27","tags":["web"]},{"url":"https://drupal.org/drupal-7.27-release-notes","tags":["web"]},{"url":"https://drupal.org/drupal-7.28","tags":["web"]},{"url":"https://drupal.org/drupal-7.28-release-notes","tags":["web"]},{"url":"https://drupal.org/drupal-7.29","tags":["web"]},{"url":"https://drupal.org/drupal-7.29-release-notes","tags":["web"]},{"url":"https://www.debian.org/security/2014/dsa-2913","tags":["web"]},{"url":"https://www.debian.org/security/2014/dsa-2983","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-5022","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-5022","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-5022","description":"Cross-site scripting (XSS) vulnerability in the Ajax system in Drupal 7.x before 7.29 allows remote attackers to inject arbitrary web script or HTML via vectors involving forms with an Ajax-enabled textfield and a file field.","status":"published","published":"2014-07-22T14:00:00Z","modified":"2024-09-16T17:34:16.14Z","updated_at":"2026-11-02T14:33:41.889751Z"}],"euvd":[{"id":"EUVD-2014-4921","description":"Cross-site scripting (XSS) vulnerability in the Ajax system in Drupal 7.x before 7.29 allows remote attackers to inject arbitrary web script or HTML via vectors involving forms with an Ajax-enabled textfield and a file field.","status":"published","published":"2014-07-22T14:00:00Z","modified":"2024-09-16T17:34:16Z","updated_at":"2026-11-03T00:55:40.580982Z"}],"ghsa":[{"id":"GHSA-j47j-5wh7-4gmm","title":"Cross-site scripting (XSS) vulnerability in the Ajax system in Drupal 7.x before 7.29 allows...","description":"Cross-site scripting (XSS) vulnerability in the Ajax system in Drupal 7.x before 7.29 allows remote attackers to inject arbitrary web script or HTML via vectors involving forms with an Ajax-enabled textfield and a file field.","status":"published","published":"2022-05-17T04:39:24Z","modified":"2023-01-28T05:02:13Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:43:44.460546Z"}],"nvd":[{"id":"CVE-2014-5022","description":"Cross-site scripting (XSS) vulnerability in the Ajax system in Drupal 7.x before 7.29 allows remote attackers to inject arbitrary web script or HTML via vectors involving forms with an Ajax-enabled textfield and a file field.","status":"published","published":"2014-07-22T14:55:10.13Z","modified":"2026-06-17T00:10:56.297Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:54.827864Z"}],"osv":[{"id":"DSA-2983-1","title":"drupal7 - security update","status":"published","published":"2014-07-20T00:00:00Z","modified":"2026-03-09T01:18:06.733893Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0322","title":"Updated drupal packages fix security vulnerabilities","description":"An information disclosure vulnerability was discovered in Drupal before 7.27.\nWhen pages are cached for anonymous users, form state may leak between\nanonymous users. Sensitive or private information recorded for one anonymous\nuser could thus be disclosed to other users interacting with the same form at\nthe same time (CVE-2014-2983).\n\nMultiple security issues in Drupal before 7.29, including a denial of service\nissue, an access bypass issue in the File module, and multiple cross-site\nscripting issues (CVE-2014-5019, CVE-2014-5020, CVE-2014-5021, CVE-2014-5022).\n\nDrupal has been updated to version 7.29, fixing this and other bugs.\n","status":"published","published":"2014-08-07T17:01:33Z","modified":"2026-04-16T06:25:32.393736246Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"UBUNTU-CVE-2014-5022","description":"Cross-site scripting (XSS) vulnerability in the Ajax system in Drupal 7.x before 7.29 allows remote attackers to inject arbitrary web script or HTML via vectors involving forms with an Ajax-enabled textfield and a file field.","status":"published","published":"2014-07-22T14:55:00Z","modified":"2025-09-08T16:43:12Z","updated_at":"2026-11-02T15:54:09.010095Z"}]}}