CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS
Percentile
65.9%
Drupal CCK plugin developer reports:
The Node reference and User reference sub-modules, which
are part of the Content Construction Kit (CCK) project, lets
administrators define node fields that are references to other
nodes or to users. When displaying a node edit form, the
titles of candidate referenced nodes or names of candidate
referenced users are not properly filtered, allowing malicious
users to inject arbitrary code on those pages. Such a cross
site scripting (XSS) attack may lead to a malicious user
gaining full administrative access.
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
FreeBSD | any | noarch | drupal6-cck | < 2.2 | UNKNOWN |