PT-2007-5269 · Drupal · Drupal

Publicado 2007-07-30 · Atualizado 2017-07-29 · CVE-2007-4064

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Drupal versions 4.7.x before 4.7.7 Drupal versions 5.x before 5.2

Description: The issue allows remote attackers to inject arbitrary web script or HTML via certain server variables, including PHP SELF. Additionally, remote authenticated administrators can inject arbitrary web script or HTML via custom content type names.

Recommendations: For Drupal versions 4.7.x before 4.7.7, update to version 4.7.7 or later. For Drupal versions 5.x before 5.2, update to version 5.2 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2007-4064

Produtos afetados

Drupal

Referências · 8

• https://exchange.xforce.ibmcloud.com/vulnerabilities/35638 · Nota
• http://drupal.org/files/sa-2007-018/advisory.txt · Nota
• http://vupen.com/english/advisories/2007/2697 · Nota
• http://securityfocus.com/bid/25097 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4064 · Nota
• http://secunia.com/advisories/26224 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2007-4064 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35637 · Nota