CVE-2011-0771

The Janrain Engage (formerly RPX) module 6.x-1.3 for Drupal does not validate the file for a profile image, which allows remote authenticated users to conduct…

published February 4, 2011

CVSS
—
EPSS
2%
Percentile
81.1
In the wild
Unconfirmed
What it is

The Janrain Engage (formerly RPX) module 6.x-1.3 for Drupal does not validate the file for a profile image, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks and possibly execute arbitrary PHP code by causing a crafted avatar to be downloaded from an external login provider site.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02062 · 81.1th percentile
Published
2011-02-04T00:00Z
EPSS history
Timeline
  • 04 FEB 00:00Z
    The Janrain Engage (formerly RPX) module 6.x-1.3 for Drupal does not validate the file for a profile image, which allows remote authenticated users to conduct…
    cvelistv5