GitHub Advisoryadvisory · Packagist

GHSA-6cj8-c359-p7q9 Drupal vulnerable to Cross-site Scripting

MEDIUM Published 2022-05-01 Modified 2024-02-09 Official page ↗
Aliases
CVE-2008-3218
Ecosystem
Packagist
Packages
drupal/drupal
Severity
Moderate
Weaknesses
CWE-79
Reviewed
2024-02-09

Affected packages

• Packagist drupal/drupal: >= 6.0, < 6.3 → fixed in 6.3

Description

Multiple cross-site scripting (XSS) vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) free tagging taxonomy terms, which are not properly handled on node preview pages, and (2) unspecified OpenID values.

Related

Alias · CVE (1)

  • CVE-2008-3218 Multiple cross-site scripting (XSS) vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References