CVE-2008-1916: XSS

Published Apr 22, 2008

Updated

Multiple cross-site scripting (XSS) vulnerabilities in the Ubercart 5.x before 5.x-1.0-rc1 module for Drupal allow remote attackers to inject arbitrary web script or HTML via text fields intended for the (1) address and (2) order information, which are later displayed on the order view page and unspecified other administrative pages, a different vulnerability than CVE-2008-1428.

Affected Software

1 affected component

Drupal Ubercart module=5-1.0-rc1

Remediation

Patch Available

http://drupal.org/node/241944

Event History

Apr 22, 2008

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2008-1916?

CVE-2008-1916 has been classified as a high severity vulnerability due to its potential to allow remote attackers to execute malicious scripts.

How do I fix CVE-2008-1916?

To fix CVE-2008-1916, upgrade the Ubercart module to version 5.x-1.0-rc1 or later.

What systems are affected by CVE-2008-1916?

CVE-2008-1916 affects the Ubercart module version 5.x before 5.x-1.0-rc1 in Drupal.

What type of vulnerability is CVE-2008-1916?

CVE-2008-1916 is a cross-site scripting (XSS) vulnerability that allows attackers to inject arbitrary web scripts or HTML.

What are the implications of CVE-2008-1916?

The implications of CVE-2008-1916 include allowing attackers to manipulate order information displayed on the order view page.