{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-01-30T00:00:00", "descriptions": [{"lang": "en", "value": "The comment_form_add_preview function in comment.module in Drupal before 4.7.6, and 5.x before 5.1, and vbDrupal, allows remote attackers with \"post comments\" privileges and access to multiple input filters to execute arbitrary code by previewing comments, which are not processed by \"normal form validation routines.\""}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-07-28T12:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://www.vbdrupal.org/forum/showthread.php?t=786"}, {"name": "22306", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/22306"}, {"name": "23960", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/23960"}, {"name": "ADV-2007-0406", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2007/0406"}, {"name": "32136", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/32136"}, {"name": "ADV-2007-0415", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2007/0415"}, {"name": "drupal-commentformaddpreview-code-execution(31940)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31940"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://drupal.org/node/113935"}, {"name": "20070129 [DRUPAL-SA-2007-005] Drupal 4.7.6 / 5.1 fixes arbitrary code execution issue", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://archives.neohapsis.com/archives/bugtraq/2007-01/0670.html"}, {"name": "23990", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/23990"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "cve@mitre.org", "ID": "CVE-2007-0626", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The comment_form_add_preview function in comment.module in Drupal before 4.7.6, and 5.x before 5.1, and vbDrupal, allows remote attackers with \"post comments\" privileges and access to multiple input filters to execute arbitrary code by previewing comments, which are not processed by \"normal form validation routines.\""}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://www.vbdrupal.org/forum/showthread.php?t=786", "refsource": "CONFIRM", "url": "http://www.vbdrupal.org/forum/showthread.php?t=786"}, {"name": "22306", "refsource": "BID", "url": "http://www.securityfocus.com/bid/22306"}, {"name": "23960", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/23960"}, {"name": "ADV-2007-0406", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2007/0406"}, {"name": "32136", "refsource": "OSVDB", "url": "http://osvdb.org/32136"}, {"name": "ADV-2007-0415", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2007/0415"}, {"name": "drupal-commentformaddpreview-code-execution(31940)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31940"}, {"name": "http://drupal.org/node/113935", "refsource": "CONFIRM", "url": "http://drupal.org/node/113935"}, {"name": "20070129 [DRUPAL-SA-2007-005] Drupal 4.7.6 / 5.1 fixes arbitrary code execution issue", "refsource": "BUGTRAQ", "url": "http://archives.neohapsis.com/archives/bugtraq/2007-01/0670.html"}, {"name": "23990", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/23990"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T12:26:54.479Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.vbdrupal.org/forum/showthread.php?t=786"}, {"name": "22306", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/22306"}, {"name": "23960", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/23960"}, {"name": "ADV-2007-0406", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2007/0406"}, {"name": "32136", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/32136"}, {"name": "ADV-2007-0415", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2007/0415"}, {"name": "drupal-commentformaddpreview-code-execution(31940)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31940"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://drupal.org/node/113935"}, {"name": "20070129 [DRUPAL-SA-2007-005] Drupal 4.7.6 / 5.1 fixes arbitrary code execution issue", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://archives.neohapsis.com/archives/bugtraq/2007-01/0670.html"}, {"name": "23990", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/23990"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-0626", "datePublished": "2007-01-31T18:00:00", "dateReserved": "2007-01-31T00:00:00", "dateUpdated": "2024-08-07T12:26:54.479Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*", "matchCriteriaId": "97D83466-2B9B-4C7F-BA2E-1CC2441EA143", "versionEndExcluding": "4.7.6", "versionStartExcluding": "4.7.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*", "matchCriteriaId": "4021FFD0-B361-42FE-91AD-61CF859F4718", "versionEndExcluding": "5.1", "versionStartIncluding": "5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The comment_form_add_preview function in comment.module in Drupal before 4.7.6, and 5.x before 5.1, and vbDrupal, allows remote attackers with \"post comments\" privileges and access to multiple input filters to execute arbitrary code by previewing comments, which are not processed by \"normal form validation routines.\""}, {"lang": "es", "value": "La funci\u00f3n comment_form_add_preview en comment.module en Drupal anterior a versi\u00f3n 4.7.6, y versi\u00f3n 5.x anterior a 5.1, y vbDrupal, permite a los atacantes remotos con privilegios de \"post comments\" y acceso a m\u00faltiples filtros de entrada para ejecutar c\u00f3digo arbitrario mediante la previsualizaci\u00f3n de comentarios, que no son procesados por \"normal form validation routines\"."}], "id": "CVE-2007-0626", "lastModified": "2021-04-19T13:42:09.930", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2007-01-31T18:28:00.000", "references": [{"source": "cve@mitre.org", "tags": ["Broken Link"], "url": "http://archives.neohapsis.com/archives/bugtraq/2007-01/0670.html"}, {"source": "cve@mitre.org", "tags": ["Patch", "Vendor Advisory"], "url": "http://drupal.org/node/113935"}, {"source": "cve@mitre.org", "tags": ["Broken Link"], "url": "http://osvdb.org/32136"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "http://secunia.com/advisories/23960"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "http://secunia.com/advisories/23990"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/22306"}, {"source": "cve@mitre.org", "tags": ["Broken Link"], "url": "http://www.vbdrupal.org/forum/showthread.php?t=786"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "http://www.vupen.com/english/advisories/2007/0406"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory"], "url": "http://www.vupen.com/english/advisories/2007/0415"}, {"source": "cve@mitre.org", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31940"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}