CVE-2005-3973

Description

Multiple cross-site scripting (XSS) vulnerabilities in Drupal 4.5.0 through 4.5.5 and 4.6.0 through 4.6.3 allow remote attackers to inject arbitrary web script or HTML via various HTML tags and values, such as the (1) legend tag and the value parameter used in (2) label and (3) input tags, possibly due to an incomplete blacklist.

References

http://www.vupen.com/english/advisories/2005/2684

http://www.securityfocus.com/bid/15677

http://www.securityfocus.com/archive/1/418292/100/0/threaded

http://www.debian.org/security/2006/dsa-958

http://secunia.com/advisories/18630

http://secunia.com/advisories/17824

http://drupal.org/files/sa-2005-007/advisory.txt

http://drupal.org/files/sa-2005-007/4.6.3.patch

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3