{"api_version":"1","generated_at":"2026-07-23T07:09:09+00:00","cve":"CVE-2015-3390","urls":{"html":"https://cve.report/CVE-2015-3390","api":"https://cve.report/api/cve/CVE-2015-3390.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2015-3390","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2015-3390"},"summary":{"title":"CVE-2015-3390","description":"Cross-site scripting (XSS) vulnerability in the Facebook Album Fetcher module for Drupal allows remote authenticated users with the \"access administration pages\" permission to inject arbitrary web script or HTML via unspecified vectors.","state":"PUBLISHED","assigner":"mitre","published_at":"2015-04-21 18:59:12","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"3.5","severity":"","vector":"AV:N/AC:M/Au:S/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:N/I:P/A:N","baseScore":3.5,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/100655","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/100655","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.drupal.org/node/2420161","name":"https://www.drupal.org/node/2420161","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"SA-CONTRIB-2015-038 - Facebook Album Fetcher - Cross Site Scripting (XSS) - Unsupported | Drupal.org","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.openwall.com/lists/oss-security/2015/02/05/16","name":"http://www.openwall.com/lists/oss-security/2015/02/05/16","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"oss-security - CVE requests for Drupal contributed modules","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/72570","name":"http://www.securityfocus.com/bid/72570","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Drupal Facebook Album Fetcher Module Multiple Unspecified Cross Site Scripting Vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3390","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3390","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2015","cve_id":"3390","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"facebook_album_fetcher_project","cpe5":"facebook_album_fetcher","cpe6":"7.x-1.x-dev","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"drupal","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T05:47:57.394Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"drupal-facebookalbumfetcher-xss(100655)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/100655"},{"name":"72570","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/72570"},{"name":"[oss-security] 20150205 CVE requests for Drupal contributed modules","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://www.openwall.com/lists/oss-security/2015/02/05/16"},{"tags":["x_refsource_MISC","x_transferred"],"url":"https://www.drupal.org/node/2420161"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2015-02-04T00:00:00.000Z","descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) vulnerability in the Facebook Album Fetcher module for Drupal allows remote authenticated users with the \"access administration pages\" permission to inject arbitrary web script or HTML via unspecified vectors."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-09-07T15:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"drupal-facebookalbumfetcher-xss(100655)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/100655"},{"name":"72570","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/72570"},{"name":"[oss-security] 20150205 CVE requests for Drupal contributed modules","tags":["mailing-list","x_refsource_MLIST"],"url":"http://www.openwall.com/lists/oss-security/2015/02/05/16"},{"tags":["x_refsource_MISC"],"url":"https://www.drupal.org/node/2420161"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2015-3390","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site scripting (XSS) vulnerability in the Facebook Album Fetcher module for Drupal allows remote authenticated users with the \"access administration pages\" permission to inject arbitrary web script or HTML via unspecified vectors."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"drupal-facebookalbumfetcher-xss(100655)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/100655"},{"name":"72570","refsource":"BID","url":"http://www.securityfocus.com/bid/72570"},{"name":"[oss-security] 20150205 CVE requests for Drupal contributed modules","refsource":"MLIST","url":"http://www.openwall.com/lists/oss-security/2015/02/05/16"},{"name":"https://www.drupal.org/node/2420161","refsource":"MISC","url":"https://www.drupal.org/node/2420161"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2015-3390","datePublished":"2015-04-21T18:00:00.000Z","dateReserved":"2015-04-21T00:00:00.000Z","dateUpdated":"2024-08-06T05:47:57.394Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2015-04-21 18:59:12","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:S/C:N/I:P/A:N","baseScore":3.5,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"SINGLE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"LOW","exploitabilityScore":6.8,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:facebook_album_fetcher_project:facebook_album_fetcher:7.x-1.x-dev:*:*:*:*:drupal:*:*","matchCriteriaId":"1879F1EF-B396-47D1-AEA7-B06C543376F7"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2015","CveId":"3390","Ordinal":"1","Title":"CVE-2015-3390","CVE":"CVE-2015-3390","Year":"2015"},"notes":[{"CveYear":"2015","CveId":"3390","Ordinal":"1","NoteData":"Cross-site scripting (XSS) vulnerability in the Facebook Album Fetcher module for Drupal allows remote authenticated users with the \"access administration pages\" permission to inject arbitrary web script or HTML via unspecified vectors.","Type":"Description","Title":"CVE-2015-3390"},{"CveYear":"2015","CveId":"3390","Ordinal":"2","NoteData":"2015-04-21","Type":"Other","Title":"Published"},{"CveYear":"2015","CveId":"3390","Ordinal":"3","NoteData":"2017-09-07","Type":"Other","Title":"Modified"}]}}}