CVEvulnerability
CVE-2007-0136
4.3 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2007-01-09
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Multiple cross-site scripting (XSS) vulnerabilities in Drupal before 4.6.11, and 4.7 before 4.7.5, allow remote attackers to inject arbitrary web script or HTML via unspecified parameters in the (1) filter and (2) system modules. NOTE: some of these details are obtained from third party information.
Affected configurations
• drupal drupal (>= 4.6.0 < 4.6.11)
• drupal drupal (>= 4.7.0 < 4.7.5)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://drupal.org/files/sa-2007-001/advisory.txt Vendor Advisory
- http://drupal.org/node/104233 Patch, Vendor Advisory
- http://marc.info/?l=full-disclosure&m=116799778408115&w=2 Third Party Advisory
- http://osvdb.org/32139 Broken Link
- http://osvdb.org/32140 Broken Link
- http://www.securityfocus.com/archive/1/456054/100/100/threaded Third Party Advisory, VDB Entry
- http://www.vupen.com/english/advisories/2007/0050 Not Applicable
- https://exchange.xforce.ibmcloud.com/vulnerabilities/31311 Third Party Advisory, VDB Entry
- http://drupal.org/files/sa-2007-001/advisory.txt Vendor Advisory
- http://drupal.org/node/104233 Patch, Vendor Advisory
- http://marc.info/?l=full-disclosure&m=116799778408115&w=2 Third Party Advisory
- http://osvdb.org/32139 Broken Link
- http://osvdb.org/32140 Broken Link
- http://www.securityfocus.com/archive/1/456054/100/100/threaded Third Party Advisory, VDB Entry
- http://www.vupen.com/english/advisories/2007/0050 Not Applicable
- https://exchange.xforce.ibmcloud.com/vulnerabilities/31311 Third Party Advisory, VDB Entry