Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Vulnerability Description
The Janrain Engage (formerly RPX) module 6.x-1.3 for Drupal does not validate the file for a profile image, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks and possibly execute arbitrary PHP code by causing a crafted avatar to be downloaded from an external login provider site.
CVSS Information
N/A
Vulnerability Type
N/A
Vulnerability Title
Drupal Janrain Engage模块跨站脚本攻击漏洞
Vulnerability Description
Drupal 是一款开源CMS，可以作为各种网站的内容管理平台。 Drupal的Janrain Engage(之前的RPX)模块6.x-1.3版本没有为档案图像验证文件。远程认证用户可以通过引起伪造的avatar从外部登录提供者的站点下载，进行跨站脚本攻击并可能执行任意PHP代码。
CVSS Information
N/A
Vulnerability Type
N/A