CVE-2008-0274: XSS
Published Jan 15, 2008
·Updated
Cross-site scripting (XSS) vulnerability in Drupal 4.7.x and 5.x, when certain .htaccess protections are disabled, allows remote attackers to inject arbitrary web script or HTML via crafted links involving theme .tpl.php files.
Affected Software
2 affected components
Drupal Drupal=5.0
Drupal Drupal=4.7
Remediation
Patch Available
Patch Available
Event History
Jan 15, 2008
CVE Published
via MITRE·07:00 PM
Data Sourced
via MITRE·07:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2008-0274?
CVE-2008-0274 is classified as a moderate severity cross-site scripting (XSS) vulnerability.
2
How do I fix CVE-2008-0274?
To fix CVE-2008-0274, ensure that proper .htaccess protections are enabled for your Drupal installation.
3
Which versions of Drupal are affected by CVE-2008-0274?
CVE-2008-0274 affects Drupal versions 4.7.x and 5.x.
4
What type of attack is possible with CVE-2008-0274?
CVE-2008-0274 allows remote attackers to inject arbitrary web scripts or HTML through crafted links.
5
What are the conditions necessary for CVE-2008-0274 to occur?
CVE-2008-0274 occurs when certain .htaccess protections are disabled in Drupal.