CVE-2014-1607: XSS

Published Jan 26, 2014

Updated

DISPUTED Cross-site scripting (XSS) vulnerability in the EventCalendar module for Drupal 7.14 allows remote attackers to inject arbitrary web script or HTML via the year parameter to eventcalander/. NOTE: this issue has been disputed by the Drupal Security Team; it may be site-specific. If so, then this CVE will be REJECTed in the future.

Affected Software

1 affected component

Drupal Drupal=7.14

Event History

Jan 26, 2014

CVE Published

via MITRE·08:00 PM

Data Sourced

via MITRE·08:00 PM

Description

Rejected

08:55 PM

Data Sourced

via NVD·08:55 PM

DescriptionSeverityWeaknessAffected Software

Jun 17, 2026

Rejected

via NVD·12:05 AM

Frequently Asked Questions

What is the severity of CVE-2014-1607?

The severity of CVE-2014-1607 is debated, as it may be site-specific and not universally applicable.

How do I fix CVE-2014-1607?

To address CVE-2014-1607, consider updating to a later version of Drupal that does not have this vulnerability.

Who is affected by CVE-2014-1607?

CVE-2014-1607 affects users of the EventCalendar module in Drupal 7.14.

What type of vulnerability is CVE-2014-1607?

CVE-2014-1607 is a cross-site scripting (XSS) vulnerability.

Can CVE-2014-1607 be exploited remotely?

Yes, CVE-2014-1607 can be exploited remotely by attackers to inject arbitrary web scripts or HTML.