PT-2008-1918 · Drupal · Drupal

Heineon · Publicado 2008-01-15 · Atualizado 2017-08-08 · CVE-2008-0274

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Drupal versions 4.7.x through 5.x

Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via crafted links involving theme .tpl.php files, when certain .htaccess protections are disabled.

Recommendations For versions 4.7.x through 5.x, enable .htaccess protections to prevent exploitation. As a temporary workaround, consider restricting access to theme .tpl.php files until a fix is applied.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-0274

Produtos afetados

Drupal

Referências · 11

• http://vbdrupal.org/forum/showthread.php?t=1349 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39605 · Nota
• http://vbdrupal.org/forum/showthread.php?p=6878 · Nota
• http://secunia.com/advisories/28422 · Correção
• http://drupal.org/node/208565 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-0274 · Nota de Segurança
• http://vupen.com/english/advisories/2008/0134 · Nota
• http://vupen.com/english/advisories/2008/0127 · Nota
• http://securityfocus.com/bid/27238 · Correção
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0274 · Nota
• http://secunia.com/advisories/28486 · Nota