PT-2006-5431 · Drupal · Drupal

Erdem Köse · Published 2006-09-08 · Updated 2017-07-20 · CVE-2006-4646

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Drupal 4.7 Pathauto module versions prior to 1.17.2.1 Drupal 4.6 Pathauto module versions prior to 1.14.2.1

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. This could potentially lead to unauthorized access or control of user sessions.

Recommendations For Drupal 4.7 Pathauto module versions prior to 1.17.2.1, update to version 1.17.2.1 or later. For Drupal 4.6 Pathauto module versions prior to 1.14.2.1, update to version 1.14.2.1 or later.

Fix

Related Identifiers

CVE-2006-4646

Affected Products

Drupal

References · 6

• http://securityfocus.com/bid/19876 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2006-4646 · Security Note
• http://secunia.com/advisories/21779 · Vendor Advisory
• http://drupal.org/node/82527 · Patch
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28771 · Note
• http://vupen.com/english/advisories/2006/3480 · Note