Description
Cross-site scripting (XSS) vulnerability in the output filter in Drupal 5.x before 5.10 and 6.x before 6.4 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
References (9)
Core 9
Core References
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=459108
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/30689
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/31825
Third Party Advisory vdb-entry
x_refsource_vupen
http://www.vupen.com/english/advisories/2008/2392
Vendor Advisory vendor-advisory
x_refsource_fedora
https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00508.html
Patch x_refsource_confirm
http://drupal.org/node/295053
Vendor Advisory vendor-advisory
x_refsource_fedora
https://www.redhat.com/archives/fedora-package-announce/2008-September/msg00259.html
Third Party Advisory third-party-advisory
x_refsource_secunia
http://secunia.com/advisories/31462
Third Party Advisory, VDB Entry vdb-entry
x_refsource_xf
https://exchange.xforce.ibmcloud.com/vulnerabilities/44445
Scores
EPSS
0.0050
EPSS Percentile
66.1%
Details
CWE
CWE-79
Status
published
Products (14)
drupal/drupal
5.0
drupal/drupal
5.1
drupal/drupal
5.2
drupal/drupal
5.3
drupal/drupal
5.4
drupal/drupal
5.5
drupal/drupal
5.6
drupal/drupal
5.7
drupal/drupal
5.8
drupal/drupal
5.9
... and 4 more
Published
Aug 27, 2008
Tracked Since
Feb 18, 2026