PT-2007-1994 · Drupal · Drupal

Published 2007-01-26 · Updated 2017-07-29 · CVE-2007-0534

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Drupal Project issue tracking versions 4.7.0 through 5.x before 20070123 Drupal Project versions 4.6.0 through 5.x before 20070123

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote authenticated users to inject arbitrary web script or HTML via certain fields on project nodes or certain project-specific settings regarding issue tracking.

Recommendations For Drupal Project issue tracking versions 4.7.0 through 5.x before 20070123, update to a version released after 20070123 to resolve the issue. For Drupal Project versions 4.6.0 through 5.x before 20070123, update to a version released after 20070123 to resolve the issue. As a temporary workaround, consider restricting access to certain fields on project nodes and project-specific settings regarding issue tracking to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-0534

Affected Products

Drupal

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2007-0534 · Security Note
• http://drupal.org/node/112146 · Note
• http://osvdb.org/32133 · Note
• http://secunia.com/advisories/23908 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/31728 · Note
• http://vupen.com/english/advisories/2007/0312 · Note
• http://securityfocus.com/bid/22224 · Note