CVE-2005-3975

Published Dec 3, 2005

Last updated 6 years ago

Overview

Description: Interpretation conflict in file.inc in Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3 allows remote authenticated users to inject arbitrary web script or HTML via HTML in a file with a GIF or JPEG file extension, which causes the HTML to be executed by a victim who views the file in Internet Explorer as a result of CVE-2005-3312. NOTE: it could be argued that this vulnerability is due to a design flaw in Internet Explorer and the proper fix should be in that browser; if so, then this should not be treated as a vulnerability in Drupal.
Source: cve@mitre.org
NVD status: Modified

Hype score: Not currently trending

Risk scores

CVSS 2.0

Type: Primary
Base score: 4
Impact score: 2.9
Exploitability score: 8
Vector string: AV:N/AC:L/Au:S/C:N/I:P/A:N

Weaknesses

nvd@nist.gov: NVD-CWE-Other

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:drupal:drupal:4.5.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "5093F703-13AA-4EEC-8659-C5EB29A54AA1"
          },
          {
            "criteria": "cpe:2.3:a:drupal:drupal:4.5.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "82317650-F136-446D-904D-354B4D26E91B"
          },
          {
            "criteria": "cpe:2.3:a:drupal:drupal:4.5.2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "06A1ACAF-A468-43F0-9FAD-FA3D48363843"
          },
          {
            "criteria": "cpe:2.3:a:drupal:drupal:4.5.3:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A68656D9-3EA0-4749-AF1B-2F9B485A02ED"
          },
          {
            "criteria": "cpe:2.3:a:drupal:drupal:4.5.4:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BFEDAA48-3F53-4B13-BB6A-CDC63E3922A5"
          },
          {
            "criteria": "cpe:2.3:a:drupal:drupal:4.5.5:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F6946291-0F27-4666-95C8-E744800D3EFB"
          },
          {
            "criteria": "cpe:2.3:a:drupal:drupal:4.6.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "95DA206C-EF72-4379-9ED8-795FCAD0BE19"
          },
          {
            "criteria": "cpe:2.3:a:drupal:drupal:4.6.1:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FC5ACB7E-0CEB-4417-839A-8B06615FC981"
          },
          {
            "criteria": "cpe:2.3:a:drupal:drupal:4.6.2:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "35BD7D35-AA9D-4589-A6BC-6D34219B7128"
          },
          {
            "criteria": "cpe:2.3:a:drupal:drupal:4.6.3:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "611B9D43-CE88-4451-A27C-7F6F24016B4F"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 2.0

Weaknesses

Configurations

References