« Volver al listado

CVE-2007-0507

Estado: ModificadaMedia (6)—

Vulnerabilidad de inyección SQL en módulo para Drupal Acidfree versiones anteriores a 4.5.x-1.0, y versiones anteriores a 4.7.x-1.0 en las series 4.7, permite a usuarios remotos autenticados con privilegios "crear álbumes acidfree" ejecutar comandos SQL de su elección mediante títulos de nodo.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Drupal — Acidfree

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2007-0507",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": true,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-01-26T00:28:00.000",
  "references": [
    {
      "url": "http://drupal.org/node/112145",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/32132",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/23895",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/22202",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/0313",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31724",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://drupal.org/node/112145",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/32132",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/23895",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/22202",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2007/0313",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/31724",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SQL injection vulnerability in the Acidfree module for Drupal before 4.6.x-1.0, and before 4.7.x-1.0 in the 4.7 series, allows remote authenticated users with \"create acidfree albums\" privileges to execute arbitrary SQL commands via node titles."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de inyección SQL en módulo para Drupal Acidfree versiones anteriores a 4.5.x-1.0, y versiones anteriores a 4.7.x-1.0 en las series 4.7, permite a usuarios remotos autenticados con privilegios \"crear álbumes acidfree\" ejecutar comandos SQL de su elección      mediante títulos de nodo."
    }
  ],
  "lastModified": "2026-06-16T22:35:43.000",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:drupal:acidfree:4.6_1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4E45F820-508F-446C-BA28-EFA45C9A2159"
            },
            {
              "criteria": "cpe:2.3:a:drupal:acidfree:4.7_1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3D32F275-8089-446F-86C5-02781905631E"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}