CVE-2006-1226: XSS
Published Mar 14, 2006
·Updated
Cross-site scripting (XSS) vulnerability in Drupal 4.5.x before 4.5.8 and 4.6.x before 4.5.8 allows remote attackers to inject arbitrary web script or HTML via unknown attack vectors.
Affected Software
6 affected components
Drupal Drupal=4.6.0
Drupal Drupal=4.5.0
Drupal Drupal=4.5.2
Drupal Drupal=4.5.1
Drupal Drupal=4.6.1
Drupal Drupal=4.5.3
Remediation
Patch Available
Patch Available
Event History
Mar 14, 2006
CVE Published
07:06 PM
Mar 15, 2006
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2006-1226?
CVE-2006-1226 is considered a critical severity vulnerability due to its potential for exploitation via cross-site scripting.
2
How do I fix CVE-2006-1226?
To fix CVE-2006-1226, upgrade Drupal to version 4.5.8 or 4.6.8 or later.
3
What versions of Drupal are affected by CVE-2006-1226?
CVE-2006-1226 affects Drupal versions 4.5.x prior to 4.5.8 and 4.6.x prior to 4.6.8.
4
What types of attacks are possible with CVE-2006-1226?
CVE-2006-1226 allows attackers to perform arbitrary web script or HTML injection through cross-site scripting.
5
Is CVE-2006-1226 still a risk for unsupported Drupal versions?
Yes, CVE-2006-1226 remains a risk for any Drupal installations that have not been updated to a secure version.