Unscored CVE-2006-5477 EUVD-2006-5462GHSA-pw4m-g5pv-hrp6

Drupal 4.6.x before 4.6.10 and 4.7.x before 4.7.4 allows form submissions to be redirected, which allows remote attackers to obtain arbitra…

Published Oct 24, 2006 · Updated Aug 7, 2024 · Assigned by mitre

Description

Drupal 4.6.x before 4.6.10 and 4.7.x before 4.7.4 allows form submissions to be redirected, which allows remote attackers to obtain arbitrary form information via a crafted URL.

References

20061019 [DRUPAL-SA-2006-026] Drupal 4.6.10 / 4.7.4 fixes HTML attribute injection issue mailing-list
20631 vdb-entry
OpenPKG-SA-2006.025-drupal vendor-advisory
drupal-form-xss(29682) vdb-entry
22486 third-party-advisory
http://drupal.org/node/88828
1764 third-party-advisory
ADV-2006-4120 vdb-entry