Unscored severity · published Jan 26, 2007
CVE-2007-0534
Multiple cross-site scripting (XSS) vulnerabilities in the (1) Project issue tracking 4.7.0 through 5.x before 20070123 and (2) Project 4.6.0 through 5.x before 20070123 modules…
–
CVSS
1.3%
EPSS
No
On KEV
Description
Multiple cross-site scripting (XSS) vulnerabilities in the (1) Project issue tracking 4.7.0 through 5.x before 20070123 and (2) Project 4.6.0 through 5.x before 20070123 modules for Drupal allow remote authenticated users to inject arbitrary web script or HTML via (a) certain "fields on project nodes" or (b) "certain project-specific settings regarding issue tracking."
Exploitation
Is it being used?
Exploit prediction (EPSS)1.3% · higher than 70% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PR
Project · Drupal
through 5; 4.6.0 · source: NVD
PI
Project Issue Tracking Module · Drupal
through 5; 4.7.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-0534
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-0534
drupal.org
http://drupal.org/node/112146
osvdb.org
http://osvdb.org/32133
secunia.com
http://secunia.com/advisories/23908
www.securityfocus.com
http://www.securityfocus.com/bid/22224
www.vupen.com
http://www.vupen.com/english/advisories/2007/0312
exchange.xforce.ibmcloud.com
https://exchange.xforce.ibmcloud.com/vulnerabilities/31728
More from Project
–
CVE-2007-4436
The Drupal Project module before 5.x-1.0, 4.7.x-2.3, and 4.7.x-1.3 and Project issue tracking module before 5.x-1.0, 4.7.x-2.4, and 4.7.x-1.4 do not properly enforce permissions,…
–
CVE-2007-0505
Unrestricted file upload vulnerability in the Project issue tracking 4.7.0 through 5.x before 20070123, a module for Drupal, allows remote authenticated users to execute arbitrary…
–
CVE-2007-0506
The project_issue_access function in the Project issue tracking 4.7.0 through 5.x before 20070123 module for Drupal allows remote authenticated users to bypass other access…