« Volver al listado

CVE-2007-3818

Estado: ModificadaBaja (3.5)—

Cross-site scripting (XSS) vulnerability in the LoginToboggan module 5.x-1.x-dev before 20070712 for Drupal allows remote authenticated users with "administer blocks" permission to inject arbitrary JavaScript and gain privileges via "the message displayed above the default user login block."

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Drupal — Logintoboggan Module

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2007-3818",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-07-17T01:30:00.000",
  "references": [
    {
      "url": "http://drupal.org/node/158921",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/37010",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://drupal.org/node/158921",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/37010",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in the LoginToboggan module 5.x-1.x-dev before 20070712 for Drupal allows remote authenticated users with \"administer blocks\" permission to inject arbitrary JavaScript and gain privileges via \"the message displayed above the default user login block.\""
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de secuencia de comandos en sitios cruzados (XSS) en el módulo LoginToboggan module 5.x-1.x-dev anterior 20070712 para Drupal permite a usuarios remotos validados con permisos de \"administración de bloques\" inyectar JavaScript de su elección y ganar privilegios a través de \"\tdel mensaje mostrado sobre el bloque de entrada del usuario del defecto.\""
    }
  ],
  "lastModified": "2026-06-16T22:42:47.503",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:drupal:logintoboggan_module:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "05EFF0E0-3361-46BF-860A-568E272B5C7C",
              "versionEndIncluding": "4.7.x-1.0"
            },
            {
              "criteria": "cpe:2.3:a:drupal:logintoboggan_module:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "2F0C8D28-AEAD-4BA5-95C3-CA0C2C80600E",
              "versionEndIncluding": "5.x-1.x-dev"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}