PT-2007-3501 · Drupal · Drupal

Published 2007-04-22 · Updated 2011-03-08 · CVE-2007-2159

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Drupal versions 4.6.x through 4.7.x-1.1 Drupal version 4.7.x-1.2 and later are not affected, but versions before 4.7.x-1.2 in the 4.7.x-1 series are vulnerable. This can be simplified to: Drupal versions 4.6.x through 4.7.x-1.1

Description The issue concerns multiple cross-site scripting (XSS) vulnerabilities in the Database Administration (dba) module. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, specifically relating to the direct display of data from the database and other portions of the user interface.

Recommendations For Drupal versions 4.6.x through 4.7.x-1.1, update to version 4.7.x-1.2 or later to resolve the issue.

Fix

Related Identifiers

CVE-2007-2159

Affected Products

Drupal

References · 5

• http://drupal.org/node/135549 · Vendor Advisory
• http://secunia.com/advisories/24848 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2159 · Security Note
• http://vupen.com/english/advisories/2007/1360 · Note
• http://osvdb.org/34961 · Note