CVE-2007-4064: XSS

Published Jul 30, 2007

Updated

Multiple cross-site scripting (XSS) vulnerabilities in Drupal 5.x before 5.2, and 4.7.x before 4.7.7, (1) allow remote attackers to inject arbitrary web script or HTML via "some server variables," including PHPSELF; and (2) allow remote authenticated administrators to inject arbitrary web script or HTML via custom content type names.

Affected Software

11 affected components

Drupal Drupal=4.7.2

Drupal Drupal=4.7.5

Drupal Drupal=4.7.3

Drupal Drupal=5.0

Drupal Drupal=4.7.0

Drupal Drupal=4.7_rev1.15

Drupal Drupal=4.7

Drupal Drupal=4.7.6

Drupal Drupal=5.1

Drupal Drupal=4.7.4

Drupal Drupal=4.7.1

Event History

Jul 30, 2007

CVE Published

05:30 PM

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2007-4064?

CVE-2007-4064 is classified as a moderate severity vulnerability affecting multiple versions of Drupal.

How do I fix CVE-2007-4064?

To fix CVE-2007-4064, upgrade your Drupal installation to version 5.2 or later, or 4.7.7 or later.

Who can exploit CVE-2007-4064?

CVE-2007-4064 can be exploited by remote attackers, particularly those with authenticated administrator access.

What types of vulnerabilities does CVE-2007-4064 include?

CVE-2007-4064 includes multiple cross-site scripting (XSS) vulnerabilities that allow arbitrary web script or HTML injection.

Which Drupal versions are affected by CVE-2007-4064?

CVE-2007-4064 affects Drupal versions 4.7.x before 4.7.7 and 5.x before 5.2.