CVE-2012-2717 Information

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Mobile Tools module 6.x-2.x before 6.x-2.3 for Drupal allow remote attackers to inject arbitrary web script or HTML via the (1) Mobile URL field or (2) Desktop URL field to the General configuration page or the (3) message to the Mobile Tools block message options.

Reference

http://drupal.org/node/1169008 http://drupal.org/node/1608828 http://drupalcode.org/project/mobile_tools.git/commitdiff/614b0fc http://osvdb.org/82410 http://secunia.com/advisories/49318 http://www.madirish.net/content/drupal-mobile-tools-6x-23-xss http://www.openwall.com/lists/oss-security/2012/06/14/3 http://www.securityfocus.com/bid/53734 https://exchange.xforce.ibmcloud.com/vulnerabilities/76002