CVE-2008-0276: XSS

Published Jan 15, 2008

Updated

Cross-site scripting (XSS) vulnerability in the Devel module before 5.x-0.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via a site variable, related to lack of escaping of the variable table.

Affected Software

48 affected components

Drupal Drupal=4.6

Drupal Drupal=5.4

Drupal Drupal=4.6.5

Drupal Drupal=4.5.4

Drupal Drupal=4.7.2

Drupal Drupal=4.6.10

Drupal Drupal=4.6.9

Drupal Drupal=5.2

Drupal Drupal=4.5.2

Drupal Drupal=4.7.5

Drupal Drupal=4.6.2

Drupal Drupal=4.6.8

Drupal Drupal=4.7.3

Drupal Drupal=4.4

Drupal Drupal=5.1_rev1.1

Drupal Drupal=4.7.10

Drupal Drupal=4.7.8

Drupal Drupal=4.5.7

Drupal Drupal=4.4.1

Drupal Drupal=4.5.1

Drupal Drupal=5.0

Drupal Drupal=4.4.2

Drupal Drupal=4.6.3

Drupal Drupal=4.5.8

Drupal Drupal=4.6.4

Drupal Drupal=4.0.0

Drupal Drupal=4.6.7

Drupal Drupal=4.5.5

Drupal Drupal=4.7.9

Drupal Drupal=4.7

Drupal Drupal=4.7.6

Drupal Drupal=4.6.11

Drupal Drupal=4.1.0

Drupal Drupal=5.1

Drupal Drupal=4.4.3

Drupal Drupal=4.7.7

Drupal Drupal=4.2.0_rc

Drupal Drupal=4.5

Drupal Drupal=5.3

Drupal Drupal=4.6.1

Drupal Drupal=4.7.4

Drupal Drupal=4.7.1

Drupal Drupal=4.5.3

Drupal Drupal=5.5.

Drupal Drupal=4.7_rev_1.2

Drupal Drupal=4.5.6

Drupal Drupal=4.7_rev_1.15

Drupal Drupal=4.6.6

Event History

Jan 15, 2008

CVE Published

via MITRE·07:00 PM

Data Sourced

via MITRE·07:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-0276?

CVE-2008-0276 is considered a medium severity vulnerability due to its impact on user data integrity and potential for exploitation via XSS.

How do I fix CVE-2008-0276?

To fix CVE-2008-0276, upgrade to a later version of the Devel module that includes proper escaping for site variables.

Which versions of Drupal are affected by CVE-2008-0276?

CVE-2008-0276 affects Drupal versions 4.0.0 to 5.5., specifically those prior to 5.x-0.1.

What type of vulnerability is CVE-2008-0276?

CVE-2008-0276 is a Cross-Site Scripting (XSS) vulnerability allowing attackers to inject arbitrary web scripts or HTML.

Can CVE-2008-0276 lead to data theft?

Yes, CVE-2008-0276 can potentially lead to data theft or manipulation by allowing unauthorized script execution in the user's browser.