CVEvulnerability
CVE-2008-0274
2.6 LOW
Official page ↗
- Status
- Modified
- Published
- 2008-01-15
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 2.6 LOW — AV:N/AC:H/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Cross-site scripting (XSS) vulnerability in Drupal 4.7.x and 5.x, when certain .htaccess protections are disabled, allows remote attackers to inject arbitrary web script or HTML via crafted links involving theme .tpl.php files.
Affected configurations
• drupal drupal 4.7
• drupal drupal 5.0
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://drupal.org/node/208565 drupal.org
- http://secunia.com/advisories/28422 Patch
- http://secunia.com/advisories/28486 secunia.com
- http://www.securityfocus.com/bid/27238 Patch
- http://www.vbdrupal.org/forum/showthread.php?p=6878 www.vbdrupal.org
- http://www.vbdrupal.org/forum/showthread.php?t=1349 www.vbdrupal.org
- http://www.vupen.com/english/advisories/2008/0127 www.vupen.com
- http://www.vupen.com/english/advisories/2008/0134 www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39605 exchange.xforce.ibmcloud.com
- http://drupal.org/node/208565 drupal.org
- http://secunia.com/advisories/28422 Patch
- http://secunia.com/advisories/28486 secunia.com
- http://www.securityfocus.com/bid/27238 Patch
- http://www.vbdrupal.org/forum/showthread.php?p=6878 www.vbdrupal.org
- http://www.vbdrupal.org/forum/showthread.php?t=1349 www.vbdrupal.org
- http://www.vupen.com/english/advisories/2008/0127 www.vupen.com
- http://www.vupen.com/english/advisories/2008/0134 www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/39605 exchange.xforce.ibmcloud.com