CVE-2005-1921

高 7.5CVE-2005-1921 · 05/07/2005 公開 · 16/06/2026 更新

要点

CVE-2005-1921 は drupal (drupal), phpxmlrpc (gggeek), xml rpc (php) に影響する深刻度「高」 (CVSS 7.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：79.1%（全脆弱性の 99.6% より高い）。
対処：4.6.2, 4.5.4, 1.8.5 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
drupal drupal	`≥ 4.6.0, < 4.6.2< 4.5.4`	`4.6.24.5.4`
phpxmlrpc gggeek	`≤ 1.1`	修正版なし
xml rpc php	`≤ 1.3.0`	修正版なし
tikiwiki cms/groupware tiki	`< 1.8.5`	`1.8.5`

概要

Eval injection vulnerability in PEAR XML_RPC 1.3.0 and earlier (aka XML-RPC or xmlrpc) and PHPXMLRPC (aka XML-RPC For PHP or php-xmlrpc) 1.1 and earlier, as used in products such as (1) WordPress, (2) Serendipity, (3) Drupal, (4) egroupware, (5) MailWatch, (6) TikiWiki, (7) phpWebSite, (8) Ampache, and others, allows remote attackers to execute arbitrary PHP code via an XML file, which is not properly sanitized before being used in an eval statement.

参考情報

marc.info · Third Party Advisory
marc.info · Third Party Advisory
marc.info · Third Party Advisory
pear.php.net/package/XML_RPC/download/1.3.1 · Patch
secunia.com/advisories/15810 · Broken Link
secunia.com/advisories/15852 · Broken Link
secunia.com/advisories/15855 · Broken Link
secunia.com/advisories/15861 · Broken Link
secunia.com/advisories/15872 · Broken Link
secunia.com/advisories/15883 · Broken Link
secunia.com/advisories/15884 · Broken Link
secunia.com/advisories/15895 · Broken Link
secunia.com/advisories/15903 · Broken Link
secunia.com/advisories/15904 · Broken Link
secunia.com/advisories/15916 · Broken Link
secunia.com/advisories/15917 · Broken Link
secunia.com/advisories/15922 · Broken Link
secunia.com/advisories/15944 · Broken Link
secunia.com/advisories/15947 · Broken Link
secunia.com/advisories/15957 · Broken Link
secunia.com/advisories/16001 · Broken Link
secunia.com/advisories/16339 · Broken Link
secunia.com/advisories/16693 · Broken Link
secunia.com/advisories/17440 · Broken Link
secunia.com/advisories/17674 · Broken Link
secunia.com/advisories/18003 · Broken Link
security.gentoo.org/glsa/glsa-200507-01.xml · Third Party Advisory
security.gentoo.org/glsa/glsa-200507-06.xml · Third Party Advisory
security.gentoo.org/glsa/glsa-200507-07.xml · Third Party Advisory
securitytracker.com/id · Broken Link
sourceforge.net/project/showfiles.php · Product
sourceforge.net/project/shownotes.php · Broken Link
ampache.org/announce/3_3_1_2.php · Broken Link
debian.org/security/2005/dsa-745 · Mailing List
debian.org/security/2005/dsa-746 · Mailing List
debian.org/security/2005/dsa-747 · Mailing List
debian.org/security/2005/dsa-789 · Mailing List
drupal.org/security/drupal-sa-2005-003/advisory.txt · Third Party Advisory
gulftech.org · Not Applicable
hardened-php.net/advisory-022005.php · Not Applicable
mandriva.com/security/advisories · Patch
novell.com/linux/security/advisories/2005_18_sr.html · Broken Link
novell.com/linux/security/advisories/2005_41_php_pear.html · Broken Link
novell.com/linux/security/advisories/2005_49_php.html · Broken Link
redhat.com/support/errata/RHSA-2005-564.html · Broken Link
securityfocus.com/archive/1/419064/100/0/threaded · Broken Link
securityfocus.com/bid/14088 · Broken Link
vupen.com/english/advisories/2005/2827 · Broken Link
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11294 · Broken Link
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A350 · Broken Link

drupal のその他の脆弱性

すべて見る →

これらの製品をお使いですか？サイトをスキャンして、脆弱なバージョンが公開されていないか確認しましょう。

無料でサイトをスキャン