CVE-2005-3975: Medium severity Drupal Drupal vulnerability
Interpretation conflict in file.inc in Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3 allows remote authenticated users to inject arbitrary web script or HTML via HTML in a file with a GIF or JPEG file extension, which causes the HTML to be executed by a victim who views the file in Internet Explorer as a result of CVE-2005-3312. NOTE: it could be argued that this vulnerability is due to a design flaw in Internet Explorer and the proper fix should be in that browser; if so, then this should not be treated as a vulnerability in Drupal.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2005-3975?
CVE-2005-3975 is classified as a high severity vulnerability due to its potential for remote code execution via malicious file uploads.
How do I fix CVE-2005-3975?
To remediate CVE-2005-3975, upgrade your Drupal installation to version 4.6.4 or later, or 4.5.6 or later.
What versions of Drupal are affected by CVE-2005-3975?
CVE-2005-3975 affects Drupal versions 4.5.0 to 4.5.5 and 4.6.0 to 4.6.3.
Can unprivileged users exploit CVE-2005-3975?
Yes, CVE-2005-3975 can be exploited by remote authenticated users with limited privileges.
What impact does CVE-2005-3975 have on website security?
CVE-2005-3975 can lead to the injection of arbitrary HTML and JavaScript code, posing a risk of cross-site scripting attacks on users viewing affected files.