CVE-2008-6533: XSS

Published Mar 26, 2009

Updated

Drupal 5.x before 5.13 and 6.x before 6.7 does not delete all related content when an input format is deleted, which prevents the content from being properly filtered and allows remote attackers to conduct cross-site scripting (XSS) attacks via unspecified vectors.

Affected Software

20 affected components

Drupal Drupal=5.0

Drupal Drupal=5.1

Drupal Drupal=5.2

Drupal Drupal=5.3

Drupal Drupal=5.4

Drupal Drupal=5.5

Drupal Drupal=5.6

Drupal Drupal=5.7

Drupal Drupal=5.8

Drupal Drupal=5.9

Drupal Drupal=5.10

Drupal Drupal=5.11

Drupal Drupal=5.12

Drupal Drupal=6.0

Drupal Drupal=6.1

Drupal Drupal=6.2

Drupal Drupal=6.3

Drupal Drupal=6.4

Drupal Drupal=6.5

Drupal Drupal=6.6

Remediation

Patch Available

http://drupal.org/node/345441

Event History

Mar 26, 2009

CVE Published

via MITRE·08:28 PM

Data Sourced

via MITRE·08:28 PM

Description

Data Sourced

via NVD·09:00 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2008-6533?

CVE-2008-6533 is considered a medium severity vulnerability due to its potential to allow cross-site scripting (XSS) attacks.

How do I fix CVE-2008-6533?

To fix CVE-2008-6533, upgrade Drupal to versions 5.13 or later, or 6.7 or later.

Which versions of Drupal are affected by CVE-2008-6533?

CVE-2008-6533 affects Drupal versions 5.x prior to 5.13 and 6.x prior to 6.7.

What types of attacks are possible with CVE-2008-6533?

CVE-2008-6533 allows attackers to potentially conduct cross-site scripting (XSS) attacks through unspecified vectors.

Is my Drupal site vulnerable if I am using a version lower than 5.13 or 6.7 due to CVE-2008-6533?

Yes, if you are using Drupal versions lower than 5.13 or 6.7, your site is vulnerable to CVE-2008-6533.