CVE-2006-5475: XSS
Published Oct 24, 2006
·Updated
Multiple cross-site scripting (XSS) vulnerabilities in the XML parser in Drupal 4.6.x before 4.6.10 and 4.7.x before 4.7.4 allow remote attackers to inject arbitrary web script or HTML via a crafted RSS feed.
Affected Software
14 affected components
Drupal Drupal=4.6.0
Drupal Drupal=4.6.5
Drupal Drupal=4.7.2
Drupal Drupal=4.6.9
Drupal Drupal=4.6.2
Drupal Drupal=4.6.8
Drupal Drupal=4.7.3
Drupal Drupal=4.6.3
Drupal Drupal=4.6.4
Drupal Drupal=4.7.0
Drupal Drupal=4.6.7
Drupal Drupal=4.6.1
Drupal Drupal=4.7.1
Drupal Drupal=4.6.6
Remediation
Patch Available
Event History
Oct 24, 2006
CVE Published
08:07 PM
Data Sourced
via NVD·08:07 PM
RemedyDescriptionSeverityAffected Software
Oct 25, 2006
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2006-5475?
CVE-2006-5475 is a medium severity vulnerability due to its potential for cross-site scripting (XSS) attacks.
2
How do I fix CVE-2006-5475?
To fix CVE-2006-5475, upgrade your Drupal installation to version 4.6.10 or later, or 4.7.4 or later.
3
What types of attacks are possible with CVE-2006-5475?
CVE-2006-5475 allows attackers to execute arbitrary web scripts or HTML through a crafted RSS feed.
4
Which versions of Drupal are affected by CVE-2006-5475?
CVE-2006-5475 affects Drupal versions 4.6.x before 4.6.10 and 4.7.x before 4.7.4.
5
How can I identify if my site is vulnerable to CVE-2006-5475?
You can identify vulnerability to CVE-2006-5475 by checking if your Drupal version is below 4.6.10 or 4.7.4.