CVE-2008-3740: XSS

Published Aug 27, 2008

Updated

Cross-site scripting (XSS) vulnerability in the output filter in Drupal 5.x before 5.10 and 6.x before 6.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Affected Software

14 affected components

Drupal Drupal=5.0

Drupal Drupal=5.1

Drupal Drupal=5.2

Drupal Drupal=5.3

Drupal Drupal=5.4

Drupal Drupal=5.5

Drupal Drupal=5.6

Drupal Drupal=5.7

Drupal Drupal=5.8

Drupal Drupal=5.9

Drupal Drupal=6.0

Drupal Drupal=6.1

Drupal Drupal=6.2

Drupal Drupal=6.3

Remediation

Patch Available

http://drupal.org/node/295053

Event History

Aug 27, 2008

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-3740?

CVE-2008-3740 is classified as a medium severity vulnerability affecting Drupal before versions 5.10 and 6.4.

How do I fix CVE-2008-3740?

To fix CVE-2008-3740, update your Drupal installation to version 5.10 or later for Drupal 5.x and 6.4 or later for Drupal 6.x.

What types of attacks can exploit CVE-2008-3740?

CVE-2008-3740 can be exploited through cross-site scripting (XSS) attacks that allow remote attackers to inject arbitrary web scripts or HTML.

Which Drupal versions are affected by CVE-2008-3740?

CVE-2008-3740 affects Drupal versions 5.x prior to 5.10 and 6.x prior to 6.4.

Is it safe to use Drupal 5.9 or earlier after the discovery of CVE-2008-3740?

No, using Drupal 5.9 or earlier is unsafe due to the vulnerabilities listed under CVE-2008-3740; it is recommended to update to a patched version.