PT-2008-1918 · Drupal · Drupal

Heineon · Published 2008-01-15 · Updated 2017-08-08 · CVE-2008-0274

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Drupal versions 4.7.x through 5.x

Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via crafted links involving theme .tpl.php files, when certain .htaccess protections are disabled.

Recommendations For versions 4.7.x through 5.x, enable .htaccess protections to prevent exploitation. As a temporary workaround, consider restricting access to theme .tpl.php files until a fix is applied.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-0274

Affected Products

Drupal

References · 11

• http://secunia.com/advisories/28422 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2008-0274 · Security Note
• http://securityfocus.com/bid/27238 · Patch
• http://vbdrupal.org/forum/showthread.php?t=1349 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/39605 · Note
• http://vbdrupal.org/forum/showthread.php?p=6878 · Note
• http://drupal.org/node/208565 · Note
• http://vupen.com/english/advisories/2008/0134 · Note
• http://vupen.com/english/advisories/2008/0127 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0274 · Note
• http://secunia.com/advisories/28486 · Note