CVE-2007-0658

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2007-02-01 · updated 2026-06-16

Description

The (1) Textimage 4.7.x before 4.7-1.2 and 5.x before 5.x-1.1 module for Drupal and the (2) Captcha 4.7.x before 4.7-1.2 and 5.x before 5.x-1.1 module for Drupal allow remote attackers to bypass the CAPTCHA test via an empty captcha element in $_SESSION.

Affected products

Drupal: 4.7, 4.7.1, 4.7.2, 4.7.3, 4.7.4, 4.7.5 (+4)
Drupal Textimage: 4.7, 5.0

References

http://cvs.drupal.org/viewcvs/drupal/contributions/modules/captcha/captcha.module?r1=1.25.2.1&r2=1.25.2.2
http://cvs.drupal.org/viewcvs/drupal/contributions/modules/textimage/captcha.inc?r1=1.1&r2=1.1.2.1
http://drupal.org/node/114364
http://drupal.org/node/114519
http://osvdb.org/32137
http://osvdb.org/32138
http://secunia.com/advisories/23983
http://secunia.com/advisories/23985
http://www.securityfocus.com/bid/22329
http://www.vupen.com/english/advisories/2007/0431
https://exchange.xforce.ibmcloud.com/vulnerabilities/31984
https://exchange.xforce.ibmcloud.com/vulnerabilities/31994

Get alerted when CVE-2007-0658 or the next vulnerability affects your stack