{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Drupal version 4.6.8 et ant\u00e9rieures ;",
      "product": {
        "name": "Drupal",
        "vendor": {
          "name": "Drupal",
          "scada": false
        }
      }
    },
    {
      "description": "Drupal version 4.7.2 et ant\u00e9rieures.",
      "product": {
        "name": "Drupal",
        "vendor": {
          "name": "Drupal",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Description\n\nUn manque de contr\u00f4le des param\u00e8tres pass\u00e9s au module user.module de\nDrupal permet \u00e0 un utilisateur distant d\u0027injecter indirectement du\nscript ou du code HTML dans les pages visualis\u00e9es par un utilisateur de\nl\u0027application Drupal vuln\u00e9rable.\n\n## Solution\n\nLes versions 4.6.9 et 4.7.3 corrigent le probl\u00e8me :\n\n    http://www.drupal.org/node/76748\n",
  "cves": [],
  "initial_release_date": "2006-08-04T00:00:00",
  "last_revision_date": "2006-08-04T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 drupal  DRUPAL-SA-2006-011 du 2 ao\u00fbt 2006 :",
      "url": "http://www.drupal.org/node/76748"
    }
  ],
  "reference": "CERTA-2006-AVI-335",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2006-08-04T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Cross-site scripting"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 dans Drupal permet \u00e0 un utilisateur distant de\nconduire une attaque de type cross-site scripting.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Drupal",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Drupal DRUPAL-SA-2006-011 du 2 ao\u00fbt 2006",
      "url": null
    }
  ]
}