CVE-2013-4274

Name of the Vulnerable Software and Affected Versions Password Policy module versions 6.x-1.x before 6.x-1.6 Password Policy module versions 7.x-1.x before 7.x-1.5

Description The issue allows remote authenticated users with the "Administer policies" permission to inject arbitrary web script or HTML via the "Password Expiration Warning" field to the "admin/config/people/password policy/add" page. This is due to a cross-site scripting (XSS) vulnerability in the password policy admin view function.

Recommendations For Password Policy module version 6.x-1.x, update to version 6.x-1.6 or later. For Password Policy module version 7.x-1.x, update to version 7.x-1.5 or later.