CVE-2011-0771

Description

The Janrain Engage (formerly RPX) module 6.x-1.3 for Drupal does not validate the file for a profile image, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks and possibly execute arbitrary PHP code by causing a crafted avatar to be downloaded from an external login provider site.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/64848

https://exchange.xforce.ibmcloud.com/vulnerabilities/64847

http://www.securityfocus.com/bid/45926

http://secunia.com/advisories/42980

http://osvdb.org/70623

http://drupal.org/node/1033154

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS