CVE-2007-5621
Severity CVSS v4.0:
Pending analysis
Type:
CWE-79
Cross-Site Scripting (XSS)
Publication date:
22/10/2007
Last modified:
09/04/2025
Description
Multiple cross-site scripting (XSS) vulnerabilities in the Token module before 4.7.x-1.5, and 5.x before 5.x-1.9, for Drupal; as used by the ASIN Field, e-Commerce, Fullname field for CCK, Invite, Node Relativity, Pathauto, PayPal Node, and Ubercart modules; allow remote authenticated users with a post comments privilege to inject arbitrary web script or HTML via unspecified vectors related to (1) comments, (2) vocabulary names, (3) term names, and (4) usernames.
Impact
Base Score 2.0
3.50
Severity 2.0
LOW
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:drupal:asin_field_module:*:*:*:*:*:*:*:* | ||
| cpe:2.3:a:drupal:drupal:4.7:*:*:*:*:*:*:* | ||
| cpe:2.3:a:drupal:drupal:5.0:*:*:*:*:*:*:* | ||
| cpe:2.3:a:drupal:drupal:5.1:*:*:*:*:*:*:* | ||
| cpe:2.3:a:drupal:drupal:5.2:*:*:*:*:*:*:* | ||
| cpe:2.3:a:drupal:e-commerce_module:*:*:*:*:*:*:*:* | ||
| cpe:2.3:a:drupal:fullname_field_for_cck:*:*:*:*:*:*:*:* | ||
| cpe:2.3:a:drupal:invite_module:*:*:*:*:*:*:*:* | ||
| cpe:2.3:a:drupal:node_relativity_module:*:*:*:*:*:*:*:* | ||
| cpe:2.3:a:drupal:pathauto_module:*:*:*:*:*:*:*:* | ||
| cpe:2.3:a:drupal:paypal_node_module:*:*:*:*:*:*:*:* | ||
| cpe:2.3:a:drupal:token_module:*:*:*:*:*:*:*:* | 1.4 (including) | |
| cpe:2.3:a:drupal:token_module:*:*:*:*:*:*:*:* | 1.8 (including) | |
| cpe:2.3:a:drupal:ubercart_module:*:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page