{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2007-01-30T00:00:00", "descriptions": [{"lang": "en", "value": "The comment_form_add_preview function in comment.module in Drupal before 4.7.6, and 5.x before 5.1, and vbDrupal, allows remote attackers with \"post comments\" privileges and access to multiple input filters to execute arbitrary code by previewing comments, which are not processed by \"normal form validation routines.\""}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-07-28T12:57:01", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "http://www.vbdrupal.org/forum/showthread.php?t=786"}, {"name": "22306", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/22306"}, {"name": "23960", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/23960"}, {"name": "ADV-2007-0406", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2007/0406"}, {"name": "32136", "tags": ["vdb-entry", "x_refsource_OSVDB"], "url": "http://osvdb.org/32136"}, {"name": "ADV-2007-0415", "tags": ["vdb-entry", "x_refsource_VUPEN"], "url": "http://www.vupen.com/english/advisories/2007/0415"}, {"name": "drupal-commentformaddpreview-code-execution(31940)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31940"}, {"tags": ["x_refsource_CONFIRM"], "url": "http://drupal.org/node/113935"}, {"name": "20070129 [DRUPAL-SA-2007-005] Drupal 4.7.6 / 5.1 fixes arbitrary code execution issue", "tags": ["mailing-list", "x_refsource_BUGTRAQ"], "url": "http://archives.neohapsis.com/archives/bugtraq/2007-01/0670.html"}, {"name": "23990", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/23990"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "[email protected]", "ID": "CVE-2007-0626", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "n/a", "version": {"version_data": [{"version_value": "n/a"}]}}]}, "vendor_name": "n/a"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "The comment_form_add_preview function in comment.module in Drupal before 4.7.6, and 5.x before 5.1, and vbDrupal, allows remote attackers with \"post comments\" privileges and access to multiple input filters to execute arbitrary code by previewing comments, which are not processed by \"normal form validation routines.\""}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "n/a"}]}]}, "references": {"reference_data": [{"name": "http://www.vbdrupal.org/forum/showthread.php?t=786", "refsource": "CONFIRM", "url": "http://www.vbdrupal.org/forum/showthread.php?t=786"}, {"name": "22306", "refsource": "BID", "url": "http://www.securityfocus.com/bid/22306"}, {"name": "23960", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/23960"}, {"name": "ADV-2007-0406", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2007/0406"}, {"name": "32136", "refsource": "OSVDB", "url": "http://osvdb.org/32136"}, {"name": "ADV-2007-0415", "refsource": "VUPEN", "url": "http://www.vupen.com/english/advisories/2007/0415"}, {"name": "drupal-commentformaddpreview-code-execution(31940)", "refsource": "XF", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31940"}, {"name": "http://drupal.org/node/113935", "refsource": "CONFIRM", "url": "http://drupal.org/node/113935"}, {"name": "20070129 [DRUPAL-SA-2007-005] Drupal 4.7.6 / 5.1 fixes arbitrary code execution issue", "refsource": "BUGTRAQ", "url": "http://archives.neohapsis.com/archives/bugtraq/2007-01/0670.html"}, {"name": "23990", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/23990"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-07T12:26:54.479Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://www.vbdrupal.org/forum/showthread.php?t=786"}, {"name": "22306", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/22306"}, {"name": "23960", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/23960"}, {"name": "ADV-2007-0406", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2007/0406"}, {"name": "32136", "tags": ["vdb-entry", "x_refsource_OSVDB", "x_transferred"], "url": "http://osvdb.org/32136"}, {"name": "ADV-2007-0415", "tags": ["vdb-entry", "x_refsource_VUPEN", "x_transferred"], "url": "http://www.vupen.com/english/advisories/2007/0415"}, {"name": "drupal-commentformaddpreview-code-execution(31940)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31940"}, {"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "http://drupal.org/node/113935"}, {"name": "20070129 [DRUPAL-SA-2007-005] Drupal 4.7.6 / 5.1 fixes arbitrary code execution issue", "tags": ["mailing-list", "x_refsource_BUGTRAQ", "x_transferred"], "url": "http://archives.neohapsis.com/archives/bugtraq/2007-01/0670.html"}, {"name": "23990", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/23990"}]}]}, "cveMetadata": {"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2007-0626", "datePublished": "2007-01-31T18:00:00", "dateReserved": "2007-01-31T00:00:00", "dateUpdated": "2024-08-07T12:26:54.479Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*", "matchCriteriaId": "97D83466-2B9B-4C7F-BA2E-1CC2441EA143", "versionEndExcluding": "4.7.6", "versionStartExcluding": "4.7.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*", "matchCriteriaId": "4021FFD0-B361-42FE-91AD-61CF859F4718", "versionEndExcluding": "5.1", "versionStartIncluding": "5.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The comment_form_add_preview function in comment.module in Drupal before 4.7.6, and 5.x before 5.1, and vbDrupal, allows remote attackers with \"post comments\" privileges and access to multiple input filters to execute arbitrary code by previewing comments, which are not processed by \"normal form validation routines.\""}, {"lang": "es", "value": "La funci\u00f3n comment_form_add_preview en comment.module en Drupal anterior a versi\u00f3n 4.7.6, y versi\u00f3n 5.x anterior a 5.1, y vbDrupal, permite a los atacantes remotos con privilegios de \"post comments\" y acceso a m\u00faltiples filtros de entrada para ejecutar c\u00f3digo arbitrario mediante la previsualizaci\u00f3n de comentarios, que no son procesados por \"normal form validation routines\"."}], "id": "CVE-2007-0626", "lastModified": "2025-04-09T00:30:58.490", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "PARTIAL", "baseScore": 6.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "[email protected]", "type": "Primary", "userInteractionRequired": false}]}, "published": "2007-01-31T18:28:00.000", "references": [{"source": "[email protected]", "tags": ["Broken Link"], "url": "http://archives.neohapsis.com/archives/bugtraq/2007-01/0670.html"}, {"source": "[email protected]", "tags": ["Patch", "Vendor Advisory"], "url": "http://drupal.org/node/113935"}, {"source": "[email protected]", "tags": ["Broken Link"], "url": "http://osvdb.org/32136"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "http://secunia.com/advisories/23960"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "http://secunia.com/advisories/23990"}, {"source": "[email protected]", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/22306"}, {"source": "[email protected]", "tags": ["Broken Link"], "url": "http://www.vbdrupal.org/forum/showthread.php?t=786"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "http://www.vupen.com/english/advisories/2007/0406"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "http://www.vupen.com/english/advisories/2007/0415"}, {"source": "[email protected]", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31940"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link"], "url": "http://archives.neohapsis.com/archives/bugtraq/2007-01/0670.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "http://drupal.org/node/113935"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link"], "url": "http://osvdb.org/32136"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "http://secunia.com/advisories/23960"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "http://secunia.com/advisories/23990"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/22306"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link"], "url": "http://www.vbdrupal.org/forum/showthread.php?t=786"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "http://www.vupen.com/english/advisories/2007/0406"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "http://www.vupen.com/english/advisories/2007/0415"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory", "VDB Entry"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31940"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "[email protected]", "type": "Primary"}]}

{}