CVE-2006-4002

Severity

43%

Complexity

86%

Confidentiality

48%

This vulnerability is addressed in the following product releases: Drupal, Drupal, 4.6.9 Drupal, Drupal, 4.7.3

Cross-site scripting (XSS) vulnerability in user.module in Drupal 4.6 before 4.6.9, and 4.7 before 4.7.3, allows remote attackers to inject arbitrary web script or HTML via the msg parameter. NOTE: portions of these details are obtained from third party information.

This vulnerability is addressed in the following product releases: Drupal, Drupal, 4.6.9 Drupal, Drupal, 4.7.3

CVSS 2.0 Base Score 4.3. CVSS Attack Vector: network. CVSS Attack Complexity: medium. CVSS Vector: (AV:N/AC:M/Au:N/C:N/I:P/A:N).

Overview

Type

Drupal

First reported 18 years ago

2006-08-07 19:04:00

Last updated 7 years ago

2017-07-20 01:32:00

Affected Software

Drupal 4.6.0

4.6.0

Drupal 4.6.1

4.6.1

Drupal 4.6.2

4.6.2

Drupal 4.6.3

4.6.3

Drupal 4.6.4

4.6.4

Drupal 4.6.5

4.6.5

Drupal 4.6.6

4.6.6

Drupal 4.6.7

4.6.7

Drupal 4.6.8

4.6.8

Drupal 4.7.0

4.7.0

Drupal 4.7.1

4.7.1

Drupal 4.7.2

4.7.2

References

http://drupal.org/node/76748

Patch, Vendor Advisory

21332