4.3

CVE-2007-4363

EPSS 1.12%
Published 15.08.2007 19:17:00
Last modified 09.04.2025 00:30:58
Source cve@mitre.org
Teams watchlist Login
Open Login

Multiple cross-site scripting (XSS) vulnerabilities in the nodereference module in Drupal Content Construction Kit (CCK) before 4.7.x-1.6, and 5.x before 5.x-1.6 ,allow remote attackers to inject arbitrary web script or HTML via nodereference fields, when using (1) the plain formatter or (2) the autocomplete text field widget without Views.module.

Affected products Warnungen 0 Metrics 2 CWE 0 References 13

Data is provided by the National Vulnerability Database (NVD)

Drupal ≫ Content Construction Kit Version4.7

Drupal ≫ Content Construction Kit Version5.2

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	1.12%	0.774

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	4.3	8.6	2.9	AV:N/AC:M/Au:N/C:N/I:P/A:N

http://drupal.org/node/166992

http://drupal.org/node/166994

http://drupal.org/node/166998

http://osvdb.org/37208

http://osvdb.org/37209

http://secunia.com/advisories/26416

Patch

Vendor Advisory

http://www.securityfocus.com/bid/25321

http://www.vupen.com/english/advisories/2007/2876

https://exchange.xforce.ibmcloud.com/vulnerabilities/36000

https://exchange.xforce.ibmcloud.com/vulnerabilities/36002

https://nvd.nist.gov/vuln/detail/CVE-2007-4363

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2007-4363

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2007-4363

EUVD