CVE-2006-4949

Cross-site scripting (XSS) vulnerability in the Drupal 4.6 Site Profile Directory (profile_pages.module) before 1.1.2.1 and the Drupal 4.7 Site Profile Directory (profile_pages.module) before 1.2.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to "lack of validation on output," possibly in the name and title parameters.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://drupal.org/node/85048
http://secunia.com/advisories/22035	Patch Vendor Advisory
http://www.osvdb.org/29029
http://www.vupen.com/english/advisories/2006/3714
https://exchange.xforce.ibmcloud.com/vulnerabilities/29061

Configurations

Configuration 1 (hide)

cpe:2.3:a:drupal:site_profile_directory_module:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2006-09-23 01:07

Updated : 2024-02-28 11:01

NVD link : CVE-2006-4949

Mitre link : CVE-2006-4949

CVE.ORG link : CVE-2006-4949

JSON object : View

Products Affected

drupal

site_profile_directory_module

CWE

NVD-CWE-Other

{"id": "CVE-2006-4949", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2006-09-23T01:07:00.000", "references": [{"url": "http://drupal.org/node/85048", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/22035", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.osvdb.org/29029", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2006/3714", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/29061", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in the Drupal 4.6 Site Profile Directory (profile_pages.module) before 1.1.2.1 and the Drupal 4.7 Site Profile Directory (profile_pages.module) before 1.2.2.1 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to \"lack of validation on output,\" possibly in the name and title parameters."}, {"lang": "es", "value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Drupal 4.6 Site Profile Directory (profile_pages.module) anterior a 1.1.2.1 y en Drupal 4.7 Site Profile Directory (profile_pages.module) anteriores a 1.2.2.1, permite a un atacante remto inyectar secuencias de comandos web o HTML a trav\u00e9s de vectores no especificados relacionados con \"la carencia de validaci\u00f3n en salida\", posiblemente en los par\u00e1metros name y title."}], "lastModified": "2017-07-20T01:33:24.603", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:drupal:site_profile_directory_module:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "29ED3A37-B781-4C91-9E5E-3D2BC2C72630"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}