CVE-2015-5487: Cross-site scripting (XSS) vulnerability in the Camtasia Relay module 6.x-2.x before 6.x-3.2 and 7.x-2.x be...

Security readout for executives and security teams

CVE-2015-5487 is an XSS issue in the Drupal Camtasia Relay contributed module. A logged-in user with the "view meta information" permission could inject script or HTML through the meta access tab area. Exposure is limited to Drupal sites using the affected module versions, but compromise could affect administrators or other users viewing affected content. Most exposed organizations are older Drupal sites that installed the Camtasia Relay module and granted "view meta information" to non-admin users. Sites without this module, without the permission assigned, or already on fixed module releases are unlikely to be exposed. Treat as a targeted legacy Drupal cleanup item, not an emergency, unless affected sites are still public-facing or have many semi-trusted users. Prioritize patching or permission restriction where the module remains installed. Mitigation focus: Upgrade Camtasia Relay to 6.x-3.2 or later for Drupal 6 branches.; Upgrade Camtasia Relay to 7.x-1.3 or later where applicable.; Restrict "view meta information" permission to trusted administrative roles only..

Prepared

Jun 13, 2026, 22:03 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.