CVE-2015-4377: Cross-site scripting (XSS) vulnerability in unspecified administration pages in the Petition module 6.x-1.x...

Security readout for executives and security teams

CVE-2015-4377 is an authenticated cross-site scripting issue in the Drupal Petition module. A user with the create petition permission could inject script or HTML that may run in administration pages. The sources do not provide CVSS, exact vectors, or evidence of active exploitation. Exposure is likely limited to Drupal 6 sites using the contributed Petition module 6.x-1.x before 6.x-1.3, especially where non-administrators have create petition permission. Treat as a targeted cleanup item for legacy Drupal assets, not an emergency, unless affected sites remain internet-facing or allow broad authenticated content creation. Mitigation focus: Inventory Drupal sites for the Petition module and installed version.; Upgrade Petition module to 6.x-1.3 or later if vendor guidance supports it.; Restrict create petition permission to trusted users until remediation is complete..

Prepared

Jun 13, 2026, 22:39 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.