CVE-2007-0505: High severity Drupal Project vulnerability

Published Jan 26, 2007

Updated

Unrestricted file upload vulnerability in the Project issue tracking 4.7.0 through 5.x before 20070123, a module for Drupal, allows remote authenticated users to execute arbitrary code by attaching a file with executable or multiple extensions to a project issue.

Affected Software

10 affected components

Drupal Project=4.6

Drupal Project=4.6_1.1

Drupal Project=4.7

Drupal Project=4.7_1.1

Drupal Project=4.7_2.1

Drupal Project=5.0

Drupal Project issue tracking module=4.7

Drupal Project issue tracking module=4.7_1.1

Drupal Project issue tracking module=4.7_2.1

Drupal Project issue tracking module=5.0

Remediation

Patch Available

http://drupal.org/node/112146

Event History

Jan 26, 2007

CVE Published

12:28 AM

CVE Published

via MITRE·05:00 AM

Data Sourced

via MITRE·05:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-0505?

CVE-2007-0505 is classified as a critical vulnerability due to the potential for arbitrary code execution.

How do I fix CVE-2007-0505?

To fix CVE-2007-0505, upgrade to a patched version of the Drupal Project Issue Tracking module released after January 23, 2007.

Who is affected by CVE-2007-0505?

CVE-2007-0505 affects remote authenticated users of the Drupal Project Issue Tracking module versions 4.7.0 through 5.x before 20070123.

What can attackers do with CVE-2007-0505?

Attackers can exploit CVE-2007-0505 to upload and execute arbitrary code on the server by attaching files with executable or multiple file extensions.

Is CVE-2007-0505 an old vulnerability?

Yes, CVE-2007-0505 was reported in 2007, but it is important for sites still using vulnerable versions of the software to address it.