CVE-2007-3817 describes a Cross-Site Scripting (XSS) vulnerability in the LoginToboggan module for Drupal, specifically versions 4.7.x-1.0, 4.7.x-1.x-dev, and 5.x-1.x-dev prior to 20070712. This flaw allows remote attackers to inject arbitrary web script or HTML through a crafted username when the module is configured to display a "Log out" link, though Drupal's default username sanitization may mitigate this. The vulnerability has a CVSS score of 4.3 (Medium), indicating a network-based attack with medium complexity, requiring no authentication, and potentially leading to partial integrity impact (e.g., session hijacking or defacement). The EPSS score is low, suggesting a minimal likelihood of exploitation. There is no evidence of active exploitation, and no public exploit code is available in Metasploit, Nuclei, or ExploitDB. Furthermore, there is no community discussion or media coverage surrounding this CVE, indicating a low level of public attention and perceived threat.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 4.7.x-1.0CPE matchmatch criteria | cpe:2.3:a:drupal:logintoboggan_module:*:*:*:*:*:*:*:* | ||
<= 5.x-1.x-devCPE matchmatch criteria | cpe:2.3:a:drupal:logintoboggan_module:*:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:M/Au:N/C:N/I:P/A:N
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.