CVE-2006-3570 - Cross-site scripting (XSS) vulnerability in the webform module in Drupal 4.6 before July 8, 2006 and

CVE-2006-3570

Summary

Cross-site scripting (XSS) vulnerability in the webform module in Drupal 4.6 before July 8, 2006 and 4.7 before July 8, 2006 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

References

http://drupal.org/node/72846
http://secunia.com/advisories/21021
http://www.securityfocus.com/bid/18947
http://www.vupen.com/english/advisories/2006/2764
https://exchange.xforce.ibmcloud.com/vulnerabilities/27685

Vulnerable Configurations

cpe:2.3:a:drupal:drupal:4.6:*:*:*:*:*:*:*
cpe:2.3:a:drupal:drupal:4.6:*:*:*:*:*:*:*
cpe:2.3:a:drupal:drupal:4.7:*:*:*:*:*:*:*
cpe:2.3:a:drupal:drupal:4.7:*:*:*:*:*:*:*

CVSS

Base:	4.3 (as of 20-07-2017 - 01:32)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
NONE	PARTIAL	NONE

cvss-vector via4

AV:N/AC:M/Au:N/C:N/I:P/A:N

refmap via4

bid	18947
confirm	http://drupal.org/node/72846
secunia	21021
vupen	ADV-2006-2764
xf	webform-unspecified-xss(27685)

Last major update

20-07-2017 - 01:32

Published

13-07-2006 - 01:05

Last modified

20-07-2017 - 01:32