CVE-2007-4363: XSS

Published Aug 15, 2007

Updated

Multiple cross-site scripting (XSS) vulnerabilities in the nodereference module in Drupal Content Construction Kit (CCK) before 4.7.x-1.6, and 5.x before 5.x-1.6 ,allow remote attackers to inject arbitrary web script or HTML via nodereference fields, when using (1) the plain formatter or (2) the autocomplete text field widget without Views.module.

Affected Software

2 affected components

Drupal Content Construction Kit=4.7

Drupal Content Construction Kit=5.2

Remediation

Patch Available

http://secunia.com/advisories/26416

Event History

Aug 15, 2007

CVE Published

07:17 PM

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2007-4363?

CVE-2007-4363 is classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.

How do I fix CVE-2007-4363?

To fix CVE-2007-4363, upgrade to the latest version of the Drupal Content Construction Kit that is not vulnerable.

What systems are affected by CVE-2007-4363?

CVE-2007-4363 affects Drupal Content Construction Kit versions earlier than 4.7.x-1.6 and 5.x prior to 5.x-1.6.

What type of vulnerability is CVE-2007-4363?

CVE-2007-4363 is a cross-site scripting (XSS) vulnerability that allows attackers to inject arbitrary web scripts or HTML.

Can CVE-2007-4363 be exploited remotely?

Yes, CVE-2007-4363 can be exploited remotely by attackers to execute malicious scripts on users' browsers.