CVE-2008-3218: XSS
Drupal security team released an advisory describing multiple security issues affecting Drupal 5.x and 6.x - SA-2008-044:
http://drupal.org/node/280571
Advisory includes: - cross site scripting issues - cross site request forgeries - session fixation issues - SQL injection
Fixed in upstream versions: 5.8 and 6.3
Upstream patches for 5.7/6.2: http://drupal.org/files/sa-2008-044/SA-2008-044-5.7.patch http://drupal.org/files/sa-2008-044/SA-2008-044-6.2.patch
Other sources
Multiple cross-site scripting (XSS) vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) free tagging taxonomy terms, which are not properly handled on node preview pages, and (2) unspecified OpenID values.
— GitHub
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2008-3218?
CVE-2008-3218 is classified as a moderate severity vulnerability due to multiple security issues including cross site scripting and session fixation.
How do I fix CVE-2008-3218?
To fix CVE-2008-3218, upgrade your Drupal installation to version 6.3 or later.
Which versions of Drupal are affected by CVE-2008-3218?
CVE-2008-3218 affects Drupal versions 5.x and 6.x prior to version 6.3.
What types of security issues are involved in CVE-2008-3218?
CVE-2008-3218 involves multiple security issues including cross site scripting, cross site request forgery, and session fixation vulnerabilities.
Is there a specific advisory for CVE-2008-3218?
Yes, the Drupal security team released advisory SA-2008-044, which details the vulnerabilities in CVE-2008-3218.