CVE-2006-0070

Published Jan 4, 2006

Last updated 3 months ago

Overview

Description: Drupal allows remote attackers to conduct cross-site scripting (XSS) attacks via an IMG tag with an unusual encoded Javascript function name, as demonstrated using variations of the alert() function. NOTE: a followup by the vendor suggests that the issue does not exist in 4.5.6 or 4.6.4 when "Filtered HTML" is enabled, and since "Full HTML" would not filter HTML by design, perhaps this should not be included in CVE
Source: cve@mitre.org
NVD status: Modified
CNA Tags: disputed

Hype score: Not currently trending

Risk scores

CVSS 2.0

Type: Primary
Base score: 4.3
Impact score: 2.9
Exploitability score: 8.6
Vector string: AV:N/AC:M/Au:N/C:N/I:P/A:N

Weaknesses

nvd@nist.gov: NVD-CWE-Other

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:drupal:drupal:4.5.6:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "79713A65-5A3A-4682-8A49-614174AB7C6F"
          },
          {
            "criteria": "cpe:2.3:a:drupal:drupal:4.6.4:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "AD1A7208-6273-4CC6-AB7B-DA855EEF2729"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 2.0

Weaknesses

Configurations

References