CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS
Percentile
71.6%
Multiple cross-site scripting (XSS) vulnerabilities in Drupal 5.x before
5.18 and 6.x before 6.12 allow (1) remote authenticated users to inject
arbitrary web script or HTML via crafted UTF-8 byte sequences that are
treated as UTF-7 by Internet Explorer 6 and 7, which are not properly
handled in the “HTML exports of books” feature; and (2) allow remote
authenticated users with administer taxonomy permissions to inject
arbitrary web script or HTML via the help text of an arbitrary vocabulary.
NOTE: vector 1 exists because of an incomplete fix for CVE-2009-1575.
Author | Note |
---|---|
mdeslaur | SA-CORE-2009-006 |