Unscored severity · published Jul 17, 2007
CVE-2007-3818
Cross-site scripting (XSS) vulnerability in the LoginToboggan module 5.x-1.x-dev before 20070712 for Drupal allows remote authenticated users with "administer blocks" permission…
–
CVSS
0.7%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the LoginToboggan module 5.x-1.x-dev before 20070712 for Drupal allows remote authenticated users with "administer blocks" permission to inject arbitrary JavaScript and gain privileges via "the message displayed above the default user login block."
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 53% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LM
Logintoboggan Module · Drupal
through 4.7.x-1.0; through 5.x-1.x-dev · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-3818
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-3818
Patch
http://drupal.org/node/158921
osvdb.org
http://osvdb.org/37010
More from Logintoboggan Module
–
CVE-2007-3817
Cross-site scripting (XSS) vulnerability in the LoginToboggan module 4.7.x-1.0, 4.7.x-1.x-dev, and 5.x-1.x-dev before 20070712 for Drupal, when configured to display a "Log out"…