PT-2008-5100 · Drupal · Drupal

Tomas Hoger · Publicado 2008-08-27 · Atualizado 2017-08-08 · CVE-2008-3741

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Drupal versions 5.x before 5.10 Drupal versions 6.x before 6.4

Description The issue allows remote authenticated users to conduct cross-site scripting (XSS) attacks. This is achieved by uploading files containing arbitrary web script or HTML, as the private filesystem trusts the MIME type sent by a web browser.

Recommendations For Drupal versions 5.x before 5.10, update to version 5.10 or later. For Drupal versions 6.x before 6.4, update to version 6.4 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-3741

DTSA-156-1

Produtos afetados

Drupal

Referências · 11

• https://exchange.xforce.ibmcloud.com/vulnerabilities/44446 · Nota
• https://bugzilla.redhat.com/show_bug.cgi?id=459108 · Nota
• http://secunia.com/advisories/31825 · Nota
• http://vupen.com/english/advisories/2008/2392 · Nota
• http://drupal.org/node/295053 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2008-3741 · Nota de Segurança
• https://redhat.com/archives/fedora-package-announce/2008-September/msg00508.html · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3741 · Nota
• http://securityfocus.com/bid/30689 · Nota
• http://secunia.com/advisories/31462 · Nota
• https://redhat.com/archives/fedora-package-announce/2008-September/msg00259.html · Aviso do Fabricante