Vulnerability in Drupal

CVE-2014-5267

modules/openid/xrds.inc in Drupal 6.x before 6.33 and 7.x before 7.31 allows remote attackers to have unspecified impact via a crafted DOCTYPE declaration in an XRDS document.

EPSS: 0.038 (88.9th percentile) — read the EPSS interpretation.

Affected products

Drupal — versions 6.0, 6.1, 6.2
N/a — versions n/a

Weakness classification (CWE)

CWE-264

References

cve@mitre.org (x_refsource_CONFIRM, Patch, Vendor Advisory)
cve@mitre.org (vendor-advisory, x_refsource_DEBIAN)
cve@mitre.org (x_refsource_CONFIRM)
cve@mitre.org (mailing-list, x_refsource_MLIST)