JVNDB-2007-000070

Drupal cross-site scripting vulnerability

Drupal, an open source content management system, contains a cross-site scripting vulnerability.

This vulnerability is different from JVN#82240092.

Base Metrics: 2.6 (Low) [IPA Score]

• Access Vector: Network
• Access Complexity: High
• Authentication: None
• Confidentiality Impact: None
• Integrity Impact: Partial
• Availability Impact: None

drupal.org

• Drupal 4.6.10 and earlier
• Drupal 4.7.4 and earlier

An arbitrary script could be executed on the browser of the user who logged into Drupal. In addition, if session information from a cookie is leaked, a remote attacker could possibly conduct session hijacking.

drupal.org

• Drupal : Drupal 4.7.5 and 4.6.11 released
• Drupal Security announcements : DRUPAL-SA-2007-001

1. CVE-2007-0136

1. JVN : JVN#13939411
2. National Vulnerability Database (NVD) : CVE-2007-0136
3. ISS X-Force Database : 31311

[2008/05/21]
  Web page published