CVE-2008-3741: XSS

Published Aug 27, 2008

Updated

The private filesystem in Drupal 5.x before 5.10 and 6.x before 6.4 trusts the MIME type sent by a web browser, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks by uploading files containing arbitrary web script or HTML.

Affected Software

14 affected components

Drupal Drupal=5.4

Drupal Drupal=6.2

Drupal Drupal=5.2

Drupal Drupal=5.7

Drupal Drupal=5.0

Drupal Drupal=6.1

Drupal Drupal=5.6

Drupal Drupal=5.1

Drupal Drupal=5.5

Drupal Drupal=6.0

Drupal Drupal=5.9

Drupal Drupal=5.8

Drupal Drupal=5.3

Drupal Drupal=6.3

Remediation

Patch Available

http://drupal.org/node/295053

Event History

Aug 27, 2008

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2008-3741?

CVE-2008-3741 is considered a high severity vulnerability due to its potential for cross-site scripting (XSS) attacks.

How do I fix CVE-2008-3741?

To fix CVE-2008-3741, update your Drupal installation to at least version 5.10 or 6.4 or higher.

Who is affected by CVE-2008-3741?

CVE-2008-3741 affects users operating Drupal versions 5.x prior to 5.10 and 6.x prior to 6.4.

What types of attacks can CVE-2008-3741 enable?

CVE-2008-3741 can enable remote authenticated users to conduct cross-site scripting (XSS) attacks.

What components of Drupal are vulnerable in CVE-2008-3741?

The vulnerability in CVE-2008-3741 resides in the private filesystem's handling of MIME types without proper validation.