PT-2008-5100 · Drupal · Drupal

Tomas Hoger · Published 2008-08-27 · Updated 2017-08-08 · CVE-2008-3741

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Drupal versions 5.x before 5.10 Drupal versions 6.x before 6.4

Description The issue allows remote authenticated users to conduct cross-site scripting (XSS) attacks. This is achieved by uploading files containing arbitrary web script or HTML, as the private filesystem trusts the MIME type sent by a web browser.

Recommendations For Drupal versions 5.x before 5.10, update to version 5.10 or later. For Drupal versions 6.x before 6.4, update to version 6.4 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-3741

DTSA-156-1

Affected Products

Drupal

References · 11

• http://drupal.org/node/295053 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2008-3741 · Security Note
• https://redhat.com/archives/fedora-package-announce/2008-September/msg00508.html · Vendor Advisory
• https://redhat.com/archives/fedora-package-announce/2008-September/msg00259.html · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44446 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=459108 · Note
• http://secunia.com/advisories/31825 · Note
• http://vupen.com/english/advisories/2008/2392 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3741 · Note
• http://securityfocus.com/bid/30689 · Note
• http://secunia.com/advisories/31462 · Note