PT-2008-4634 · Drupal · Drupal

Tomas Hoger · Publicado 2008-07-18 · Atualizado 2022-05-01 · CVE-2008-3218

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Drupal versions prior to 6.3

Description: The issue is related to multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The vulnerabilities are related to vectors such as free tagging taxonomy terms, which are not properly handled on node preview pages, and unspecified OpenID values.

Recommendations: For versions prior to 6.3, update to version 6.3 or later to resolve the issue.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-3218

GHSA-6CJ8-C359-P7Q9

Produtos afetados

Drupal

Referências · 15

• https://github.com/drupal/drupal · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-3218 · Nota de Segurança
• https://redhat.com/archives/fedora-package-announce/2008-July/msg00551.html · Aviso do Fabricante
• https://redhat.com/archives/fedora-package-announce/2008-August/msg00016.html · Aviso do Fabricante
• https://web.archive.org/web/20081007110725/http://securityfocus.com/bid/30168 · Nota
• http://securityfocus.com/bid/30168 · Nota
• http://openwall.com/lists/oss-security/2008/07/10/3 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=454849 · Correção
• http://drupal.org/node/280571 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-6cj8-c359-p7q9 · Aviso do Fabricante
• http://secunia.com/advisories/31079 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3218 · Nota
• https://redhat.com/archives/fedora-package-announce/2008-July/msg00527.html · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43704 · Nota
• https://web.archive.org/web/20080804010537/http://secunia.com/advisories/31079 · Nota