{"id":"CVE-2015-6665","aliases":["DSA-3346-1","EUVD-2015-6603","GHSA-fvm9-qc7j-544c","MGASA-2015-0328","UBUNTU-CVE-2015-6665"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the...","description":"Cross-site scripting (XSS) vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving a whitelisted HTML element, possibly related to the \"a\" tag.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.02677,"percentile":0.85885,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2015-08-24T14:00:00Z","modified":"2026-06-17T00:31:12Z","affected":[{"source":"osv","ecosystem":"Debian:7","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.14-2+deb7u11"}]}],"versions":["7.14-2","7.14-2+deb7u1","7.14-2+deb7u10","7.14-2+deb7u10~bpo60+1","7.14-2+deb7u11~bpo60+1","7.14-2+deb7u1~bpo60+1","7.14-2+deb7u2","7.14-2+deb7u2~bpo60+1","7.14-2+deb7u3","7.14-2+deb7u4","7.14-2+deb7u4~bpo60+1","7.14-2+deb7u5","7.14-2+deb7u6","7.14-2+deb7u6~bpo60+1","7.14-2+deb7u7","7.14-2+deb7u7~bpo60+1","7.14-2+deb7u8","7.14-2+deb7u9","7.14-2+deb7u9~bpo60+1"],"bundled":5},{"source":"osv","ecosystem":"Debian:8","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.32-1+deb8u5"}]}],"versions":["7.32-1+deb8u3","7.32-1+deb8u4","7.32-1+deb8u4~bpo70+1","7.32-1+deb8u5~bpo70+1"],"bundled":5},{"source":"osv","ecosystem":"Mageia:4","package":"drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.39-1.mga4"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:5","package":"drupal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.39-1.mga5"}]}],"bundled":5},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"drupal7","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["7.23-1","7.24-1","7.24-2","7.26-1","7.26-1ubuntu0.1","7.26-1ubuntu0.1+esm1","7.26-1ubuntu0.1+esm2","7.26-1ubuntu0.1+esm3"]}],"products":[{"vendor":"chaos_tool_suite_project","product":"ctools"},{"vendor":"drupal","product":"drupal"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165723.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165674.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165061.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://www.securitytracker.com/id/1033358","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"https://www.drupal.org/node/2554145","tags":["x_refsource_MISC","x_transferred","Patch","Vendor Advisory","report"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165840.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165733.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://www.securityfocus.com/bid/76431","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://www.debian.org/security/2015/dsa-3346","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred"]},{"url":"https://www.drupal.org/SA-CORE-2015-003","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","web","report"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165690.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://www.drupal.org/node/2554133","tags":["x_refsource_CONFIRM","x_transferred","Patch","report"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165724.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165704.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-September/165695.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-6665"},{"url":"https://github.com/advisories/GHSA-fvm9-qc7j-544c"},{"url":"https://advisories.mageia.org/MGASA-2015-0328.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=16630","tags":["report"]},{"url":"https://www.drupal.org/drupal-7.39","tags":["web"]},{"url":"https://www.drupal.org/drupal-7.39-release-notes","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-6665","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-6665","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-6665","description":"Cross-site scripting (XSS) vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving a whitelisted HTML element, possibly related to the \"a\" tag.","status":"published","published":"2015-08-24T14:00:00Z","modified":"2024-08-06T07:29:24.441Z","updated_at":"2026-11-02T14:35:42.680858Z"}],"euvd":[{"id":"EUVD-2015-6603","description":"Cross-site scripting (XSS) vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving a whitelisted HTML element, possibly related to the \"a\" tag.","status":"published","published":"2015-08-24T14:00:00Z","modified":"2024-08-06T07:29:24Z","updated_at":"2026-11-03T02:21:55.290228Z"}],"ghsa":[{"id":"GHSA-fvm9-qc7j-544c","title":"Cross-site scripting (XSS) vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the...","description":"Cross-site scripting (XSS) vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving a whitelisted HTML element, possibly related to the \"a\" tag.","status":"published","published":"2022-05-17T03:15:48Z","modified":"2023-01-27T05:06:35Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:42:56.687968Z"}],"nvd":[{"id":"CVE-2015-6665","description":"Cross-site scripting (XSS) vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving a whitelisted HTML element, possibly related to the \"a\" tag.","status":"published","published":"2015-08-24T14:59:22.68Z","modified":"2026-06-17T00:31:12.69Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:03:08.998581Z"}],"osv":[{"id":"DSA-3346-1","title":"drupal7 - security update","status":"published","published":"2015-08-31T00:00:00Z","modified":"2026-03-09T01:21:12.171232Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"MGASA-2015-0328","title":"Updated drupal packages fix security vulnerabilities","description":"Cross-site scripting (XSS) vulnerability in the Autocomplete system in Drupal\nbefore 7.39 allows remote attackers to inject arbitrary web script or HTML\nvia a crafted URL, related to uploading files (CVE-2015-6658).\n\nSQL injection vulnerability in the SQL comment filtering system in the\nDatabase API in Drupal before 7.39 allows remote attackers to execute\narbitrary SQL commands via an SQL comment (CVE-2015-6659).\n\nThe Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly\nvalidate the form token, which allows remote attackers to conduct CSRF\nattacks that upload files in a different user's account via vectors related\nto \"file upload value callbacks\" (CVE-2015-6660).\n\nDrupal before 7.39 allows remote attackers to obtain sensitive node titles by\nreading the menu (CVE-2015-6661).\n\nCross-site scripting (XSS) vulnerability in the Ajax handler in Drupal before\n7.39 allows remote attackers to inject arbitrary web script or HTML via\nvectors involving a whitelisted HTML element, possibly related to the \"a\" tag\n(CVE-2015-6665).\n","status":"published","published":"2015-08-27T20:49:46Z","modified":"2026-04-16T06:23:32.397625865Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"UBUNTU-CVE-2015-6665","description":"Cross-site scripting (XSS) vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Drupal allows remote attackers to inject arbitrary web script or HTML via vectors involving a whitelisted HTML element, possibly related to the \"a\" tag.","status":"published","published":"2015-08-24T14:59:00Z","modified":"2025-09-08T16:43:27Z","updated_at":"2026-11-02T15:54:10.385269Z"}]}}