PT-2007-3501 · Drupal · Drupal

Publicado 2007-04-22 · Atualizado 2011-03-08 · CVE-2007-2159

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Drupal versions 4.6.x through 4.7.x-1.1 Drupal version 4.7.x-1.2 and later are not affected, but versions before 4.7.x-1.2 in the 4.7.x-1 series are vulnerable. This can be simplified to: Drupal versions 4.6.x through 4.7.x-1.1

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the Database Administration (dba) module. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, specifically relating to the direct display of data from the database and other portions of the user interface.

Recommendations For Drupal versions 4.6.x through 4.7.x-1.1, update to version 4.7.x-1.2 or later to resolve the issue.

Correção

Identificadores relacionados

CVE-2007-2159

Produtos afetados

Drupal

Referências · 5

• http://drupal.org/node/135549 · Aviso do Fabricante
• http://secunia.com/advisories/24848 · Aviso do Fabricante
• http://vupen.com/english/advisories/2007/1360 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-2159 · Nota de Segurança
• http://osvdb.org/34961 · Nota