CVE-2009-1575

2009-05-0600:00:00

ubuntu.com

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

0.003

Percentile

71.6%

JSON

Cross-site scripting (XSS) vulnerability in Drupal 5.x before 5.17 and 6.x
before 6.11, as used in vbDrupal before 5.17.0, allows remote attackers to
inject arbitrary web script or HTML via crafted UTF-8 byte sequences before
the Content-Type meta tag, which are treated as UTF-7 by Internet Explorer
6 and 7.

Notes

Author	Note
mdeslaur	SA-CORE-2009-005

OSVersionArchitecturePackageVersionFilename
ubuntu8.04noarchdrupal5< 5.7-1ubuntu1.2UNKNOWN
ubuntu8.10noarchdrupal5< 5.10-1ubuntu1.1UNKNOWN
ubuntu9.04noarchdrupal5< 5.15-1ubuntu1.1UNKNOWN
ubuntu9.04noarchdrupal6< 6.10-1ubuntu0.1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	8.04	noarch	drupal5	< 5.7-1ubuntu1.2	UNKNOWN
ubuntu	8.10	noarch	drupal5	< 5.10-1ubuntu1.1	UNKNOWN
ubuntu	9.04	noarch	drupal5	< 5.15-1ubuntu1.1	UNKNOWN
ubuntu	9.04	noarch	drupal6	< 6.10-1ubuntu0.1	UNKNOWN