Previews on comments were not passed through normal form validation routines, enabling users with the 'post comments' permission and access to more than one input filter to execute arbitrary code.
Vulnerable Systems:
* Drupal 4.7.x before version 4.7.6.
* Drupal 5.x before version 5.1.
Previews on comments were not passed through normal form validation routines, enabling users with the 'post comments' permission and access to more than one input filter to execute arbitrary code. By default, anonymous and authenticated users have access to only one input format.
Immediate workarounds include: disabling the comment module, revoking the 'post comments' permission for all users or limiting access to one input format.
Vendor Status:
Drupal issued an update for this vulnerability
