CVE-2008-0273: XSS
Interpretation conflict in Drupal 4.7.x before 4.7.11 and 5.x before 5.6, when Internet Explorer 6 is used, allows remote attackers to conduct cross-site scripting (XSS) attacks via invalid UTF-8 byte sequences, which are not processed as UTF-8 by Drupal's HTML filtering, but are processed as UTF-8 by Internet Explorer, effectively removing characters from the document and defeating the HTML protection mechanism.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2008-0273?
CVE-2008-0273 has a moderate severity rating due to its potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2008-0273?
To fix CVE-2008-0273, upgrade to Drupal versions 4.7.11 or 5.6 or later.
Which versions of Drupal are affected by CVE-2008-0273?
CVE-2008-0273 affects Drupal versions prior to 4.7.11 and 5.x before 5.6.
What type of attack does CVE-2008-0273 facilitate?
CVE-2008-0273 facilitates cross-site scripting (XSS) attacks via invalid UTF-8 byte sequences.
How does CVE-2008-0273 exploit vulnerabilities in Drupal?
CVE-2008-0273 exploits vulnerabilities by causing Drupal's HTML filtering to improperly process UTF-8 encoding, enabling attackers to inject malicious scripts.