CVE-2008-6533

Drupal 5.x before 5.13 and 6.x before 6.7 does not delete all related content when an input format is deleted, which prevents the content from being properly filtered and allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://drupal.org/node/345441	Patch Vendor Advisory
http://secunia.com/advisories/33112	Vendor Advisory
http://www.osvdb.org/50662
http://www.vupen.com/english/advisories/2008/3414
http://secunia.com/advisories/33147
https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00767.html
https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00740.html
https://exchange.xforce.ibmcloud.com/vulnerabilities/47259

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:drupal:drupal:5.11:::::::*
	cpe:2.3:a:drupal:drupal:5.10:::::::*
	cpe:2.3:a:drupal:drupal:5.3:::::::*
	cpe:2.3:a:drupal:drupal:5.2:::::::*
	cpe:2.3:a:drupal:drupal:6.4:::::::*
	cpe:2.3:a:drupal:drupal:5.7:::::::*
	cpe:2.3:a:drupal:drupal:5.6:::::::*
	cpe:2.3:a:drupal:drupal:6.0:::::::*
	cpe:2.3:a:drupal:drupal:6.1:::::::*
	cpe:2.3:a:drupal:drupal:5.9:::::::*
	cpe:2.3:a:drupal:drupal:5.8:::::::*
	cpe:2.3:a:drupal:drupal:5.4:::::::*
	cpe:2.3:a:drupal:drupal:6.2:::::::*
	cpe:2.3:a:drupal:drupal:5.12:::::::*
	cpe:2.3:a:drupal:drupal:5.0:::::::*
	cpe:2.3:a:drupal:drupal:5.1:::::::*
	cpe:2.3:a:drupal:drupal:6.5:::::::*
	cpe:2.3:a:drupal:drupal:5.5:::::::*
	cpe:2.3:a:drupal:drupal:6.6:::::::*
	cpe:2.3:a:drupal:drupal:6.3:::::::*

Information

Published : 2009-03-26 14:00

Updated : 2017-08-16 18:29

NVD link : CVE-2008-6533

Mitre link : CVE-2008-6533

JSON object : View

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Advertisement

Products Affected

drupal

drupal

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://drupal.org/node/345441", "name": "http://drupal.org/node/345441", "tags": ["Patch", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://secunia.com/advisories/33112", "name": "33112", "tags": ["Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://www.osvdb.org/50662", "name": "50662", "tags": [], "refsource": "OSVDB"}, {"url": "http://www.vupen.com/english/advisories/2008/3414", "name": "ADV-2008-3414", "tags": [], "refsource": "VUPEN"}, {"url": "http://secunia.com/advisories/33147", "name": "33147", "tags": [], "refsource": "SECUNIA"}, {"url": "https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00767.html", "name": "FEDORA-2008-11213", "tags": [], "refsource": "FEDORA"}, {"url": "https://www.redhat.com/archives/fedora-package-announce/2008-December/msg00740.html", "name": "FEDORA-2008-11196", "tags": [], "refsource": "FEDORA"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/47259", "name": "drupal-htmltags-xss(47259)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Drupal 5.x before 5.13 and 6.x before 6.7 does not delete all related content when an input format is deleted, which prevents the content from being properly filtered and allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-79"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2008-6533", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2009-03-26T21:00Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:drupal:drupal:5.11:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:drupal:drupal:5.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:drupal:drupal:5.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:drupal:drupal:5.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:drupal:drupal:6.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:drupal:drupal:5.7:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:drupal:drupal:5.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:drupal:drupal:6.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:drupal:drupal:6.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:drupal:drupal:5.9:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:drupal:drupal:5.8:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:drupal:drupal:5.4:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:drupal:drupal:6.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:drupal:drupal:5.12:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:drupal:drupal:5.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:drupal:drupal:5.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:drupal:drupal:6.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:drupal:drupal:5.5:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:drupal:drupal:6.6:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:drupal:drupal:6.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-08-17T01:29Z"}