CVE-2007-5621: XSS
Published Oct 22, 2007
·Updated
Multiple cross-site scripting (XSS) vulnerabilities in the Token module before 4.7.x-1.5, and 5.x before 5.x-1.9, for Drupal; as used by the ASIN Field, e-Commerce, Fullname field for CCK, Invite, Node Relativity, Pathauto, PayPal Node, and Ubercart modules; allow remote authenticated users with a post comments privilege to inject arbitrary web script or HTML via unspecified vectors related to (1) comments, (2) vocabulary names, (3) term names, and (4) usernames.
Affected Software
14 affected components
Drupal Asin Field Module
Drupal Drupal=4.7
Drupal Drupal=5.0
Drupal Drupal=5.1
Drupal Drupal=5.2
Drupal E-commerce Module
Drupal Fullname field for CCK
Drupal Invite Module
Drupal Node Relativity Module
Drupal Pathauto Module
Drupal Paypal Node Module
Drupal Token module<=1.4
Drupal Token module<=1.8
Drupal Ubercart module
Remediation
Patch Available
Patch Available
Event History
Oct 22, 2007
CVE Published
07:46 PM
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Frequently Asked Questions
1
Is CVE-2007-5621 a serious issue?
Yes, CVE-2007-5621 is considered a serious issue as it allows for cross-site scripting, which can lead to unauthorized actions or data exposure.