PT-2007-5269 · Drupal · Drupal

Published 2007-07-30 · Updated 2017-07-29 · CVE-2007-4064

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Drupal versions 4.7.x before 4.7.7 Drupal versions 5.x before 5.2

Description: The issue allows remote attackers to inject arbitrary web script or HTML via certain server variables, including PHP SELF. Additionally, remote authenticated administrators can inject arbitrary web script or HTML via custom content type names.

Recommendations: For Drupal versions 4.7.x before 4.7.7, update to version 4.7.7 or later. For Drupal versions 5.x before 5.2, update to version 5.2 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2007-4064

Affected Products

Drupal

References · 8

• http://secunia.com/advisories/26224 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-4064 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35638 · Note
• http://drupal.org/files/sa-2007-018/advisory.txt · Note
• http://vupen.com/english/advisories/2007/2697 · Note
• http://securityfocus.com/bid/25097 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4064 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35637 · Note