CVE-2006-6646: XSS
Multiple cross-site scripting (XSS) vulnerabilities in Drupal (1) Project Issue Tracking 4.7.x-1.0 and 4.7.x-2.0, and (2) Project 4.6.x-1.0, 4.7.x-1.0, and 4.7.x-2.0 allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, which do not use the checkplain function.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2006-6646?
The severity of CVE-2006-6646 is classified as moderate due to its potential for exploitation via cross-site scripting.
How do I fix CVE-2006-6646?
To fix CVE-2006-6646, ensure that all user inputs are properly sanitized using the check_plain function in Drupal.
What versions of Drupal are affected by CVE-2006-6646?
CVE-2006-6646 affects Drupal versions 4.6.x and 4.7.x, specifically 4.6.1, 4.7.1, and the issue tracking versions 4.7.2.
What types of attacks can CVE-2006-6646 enable?
CVE-2006-6646 can enable remote attackers to conduct cross-site scripting (XSS) attacks, allowing them to inject arbitrary web scripts or HTML.
Is CVE-2006-6646 still a risk for current Drupal installations?
CVE-2006-6646 poses a risk only for outdated Drupal installations, and should be mitigated by updating to the latest versions.