CVE-2007-3818: XSS
Cross-site scripting (XSS) vulnerability in the LoginToboggan module 5.x-1.x-dev before 20070712 for Drupal allows remote authenticated users with "administer blocks" permission to inject arbitrary JavaScript and gain privileges via "the message displayed above the default user login block."
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2007-3818?
CVE-2007-3818 is considered a moderate severity vulnerability due to its potential for cross-site scripting attacks.
How do I fix CVE-2007-3818?
To fix CVE-2007-3818, update the LoginToboggan module for Drupal to version 5.x-1.x-dev or 4.7.x-1.0 or later.
Who is affected by CVE-2007-3818?
Remote authenticated users with 'administer blocks' permission on affected versions of the LoginToboggan module are vulnerable to CVE-2007-3818.
What are the risks associated with CVE-2007-3818?
The risks associated with CVE-2007-3818 include unauthorized privilege escalation through injected JavaScript.
Is user input validated in CVE-2007-3818?
No, CVE-2007-3818 highlights a lack of proper validation of user input in the LoginToboggan module, allowing for XSS attacks.