Boost module for Drupal file overwrite
| boost-drupal-file-overwrite (36939) |  Medium Risk |
Description:
Boost module for Drupal could allow a remote attacker to overwrite arbitrary files on the system, caused by a vulnerability in the directory. An attacker could exploit this vulnerability to create or overwrite arbitrary files on the system.
Platforms Affected:
- Drupal, Boost module for Drupal 4.7.x-1
- Drupal, Boost module for Drupal 5.x-0
Remedy:
Refer to DRUPAL-SA-2007-022 for patch, upgrade, or suggested workaround information. See References.
Consequences:
File Manipulation
References:
- DRUPAL-SA-2007-022, Boost - file overwrite at http://drupal.org/node/180591.
- CVE-2007-5270: Unspecified vulnerability in the Boost module before 4.7.x-1.0, and 5.x before 5.x-1.0, for Drupal allows remote attackers to create or overwrite arbitrary files, and conduct cross-site scripting attacks (XSS) via unspecified vectors.
Reported:
Oct 03, 2007
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
Copyright (c) 1994-2008 Internet Security Systems, Inc. All rights reserved worldwide.
For corrections or additions please email xforce@iss.net