CVE-2008-6170: XSS
Published Feb 19, 2009
·Updated
Cross-site scripting (XSS) vulnerability in Drupal 5.x before 5.12 and 6.x before 6.6 allows remote authenticated users with create book content or edit node book hierarchy permissions to inject arbitrary web script or HTML via the book page title.
Affected Software
18 affected components
Drupal Drupal=5.10
Drupal Drupal=5.4
Drupal Drupal=6.2
Drupal Drupal=5.2
Drupal Drupal=5.7
Drupal Drupal=6.4
Drupal Drupal=5.0
Drupal Drupal=6.1
Drupal Drupal=5.6
Drupal Drupal=5.1
Drupal Drupal=6.5
Drupal Drupal=5.5
Drupal Drupal=6.0
Drupal Drupal=5.9
Drupal Drupal=5.8
Drupal Drupal=5.3
Drupal Drupal=6.3
Drupal Drupal=5.11
Remediation
Patch Available
Event History
Feb 19, 2009
CVE Published
via MITRE·03:02 PM
Data Sourced
via MITRE·03:02 PM
Description
Data Sourced
via NVD·03:30 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2008-6170?
CVE-2008-6170 is rated as a medium severity vulnerability.
2
How do I fix CVE-2008-6170?
To fix CVE-2008-6170, upgrade your Drupal installation to version 5.12 or 6.6 or later.
3
What types of systems are affected by CVE-2008-6170?
CVE-2008-6170 affects Drupal versions 5.x before 5.12 and 6.x before 6.6.
4
Who can exploit CVE-2008-6170?
Remote authenticated users with create book content or edit node book hierarchy permissions can exploit CVE-2008-6170.
5
What kind of vulnerability is CVE-2008-6170?
CVE-2008-6170 is a cross-site scripting (XSS) vulnerability.