PT-2007-1994 · Drupal · Drupal

Publicado 2007-01-26 · Atualizado 2017-07-29 · CVE-2007-0534

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Drupal Project issue tracking versions 4.7.0 through 5.x before 20070123 Drupal Project versions 4.6.0 through 5.x before 20070123

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML via certain fields on project nodes or certain project-specific settings regarding issue tracking.

Recommendations For Drupal Project issue tracking versions 4.7.0 through 5.x before 20070123, update to a version released after 20070123 to resolve the issue. For Drupal Project versions 4.6.0 through 5.x before 20070123, update to a version released after 20070123 to resolve the issue. As a temporary workaround, consider restricting access to certain fields on project nodes and project-specific settings regarding issue tracking to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2007-0534

Produtos afetados

Drupal

Referências · 7

• http://drupal.org/node/112146 · Nota
• http://osvdb.org/32133 · Nota
• http://secunia.com/advisories/23908 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31728 · Nota
• http://vupen.com/english/advisories/2007/0312 · Nota
• http://securityfocus.com/bid/22224 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-0534 · Nota de Segurança