PT-2007-1965 · Drupal · Drupal

Published 2007-01-26 · Updated 2017-07-29 · CVE-2007-0505

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Drupal Project issue tracking module versions 4.7.0 through 5.x before 20070123

Description The issue allows remote authenticated users to execute arbitrary code by attaching a file with executable or multiple extensions to a project issue.

Recommendations For versions 4.7.0 through 5.x before 20070123, consider restricting file uploads to only authorized users and validating file extensions to prevent executable files from being uploaded until a fix is available.

Fix

Related Identifiers

CVE-2007-0505

Affected Products

Drupal

References · 7

• http://drupal.org/node/112146 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-0505 · Security Note
• http://securityfocus.com/bid/22224 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31729 · Note
• http://vupen.com/english/advisories/2007/0312 · Note
• http://secunia.com/advisories/23887 · Note
• http://osvdb.org/32134 · Note