What’s Vulnerable › Vulnerabilities

CVE-2014-5267

• Severity: medium (CVSS 6.8 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2014-09-30 · updated 2026-06-17
• Weakness: CWE-264

Description

modules/openid/xrds.inc in Drupal 6.x before 6.33 and 7.x before 7.31 allows remote attackers to have unspecified impact via a crafted DOCTYPE declaration in an XRDS document.

Affected products

• Drupal: 6.0, 6.0-beta1, 6.0-beta2, 6.0-beta3, 6.0-beta4, 6.0-dev (+82)

References

• http://cgit.drupalcode.org/drupal/diff/modules/openid/xrds.inc?id=1849830
• http://openwall.com/lists/oss-security/2014/08/16/4
• http://www.debian.org/security/2014/dsa-2999
• https://www.drupal.org/SA-CORE-2014-004
• http://cgit.drupalcode.org/drupal/diff/modules/openid/xrds.inc?id=1849830
• http://openwall.com/lists/oss-security/2014/08/16/4
• http://www.debian.org/security/2014/dsa-2999
• https://www.drupal.org/SA-CORE-2014-004

Get alerted when CVE-2014-5267 or the next vulnerability affects your stack