PT-2009-1474 · Drupal · Ajax Checklist

Published 2009-01-28 · Updated 2017-08-08 · CVE-2008-5999

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Ajax Checklist module versions prior to 5.x-1.1 for Drupal

Description The issue allows remote authenticated users with create and edit permissions for posts to inject arbitrary web script or HTML. This is achieved via unspecified vectors involving the ajax checklist filter.

Recommendations For versions prior to 5.x-1.1, update to version 5.x-1.1 or later to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-5999

Affected Products

Ajax Checklist

References · 4

• http://secunia.com/advisories/32009 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-5999 · Security Note
• http://drupal.org/node/312968 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45412 · Note