CVE-2008-6170

Cross-site scripting (XSS) vulnerability in Drupal 5.x before 5.12 and 6.x before 6.6 allows remote authenticated users with create book content or edit node book hierarchy permissions to inject arbitrary web script or HTML via the book page title.

Link	Resource
http://secunia.com/advisories/32297	Vendor Advisory
http://www.securityfocus.com/bid/31882
http://drupal.org/node/324824	Patch Vendor Advisory
https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00826.html
https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00783.html
http://secunia.com/advisories/32441
http://www.vupen.com/english/advisories/2008/2913
https://exchange.xforce.ibmcloud.com/vulnerabilities/46052

Configuration 1

cpe:2.3:a:drupal:drupal:5.10:*:*:*:*:*:*:* cpe:2.3:a:drupal:drupal:5.4:*:*:*:*:*:*:* cpe:2.3:a:drupal:drupal:6.2:*:*:*:*:*:*:* cpe:2.3:a:drupal:drupal:5.2:*:*:*:*:*:*:* cpe:2.3:a:drupal:drupal:5.7:*:*:*:*:*:*:* cpe:2.3:a:drupal:drupal:6.4:*:*:*:*:*:*:* cpe:2.3:a:drupal:drupal:5.0:*:*:*:*:*:*:* cpe:2.3:a:drupal:drupal:6.1:*:*:*:*:*:*:* cpe:2.3:a:drupal:drupal:5.6:*:*:*:*:*:*:* cpe:2.3:a:drupal:drupal:5.1:*:*:*:*:*:*:* cpe:2.3:a:drupal:drupal:6.5:*:*:*:*:*:*:* cpe:2.3:a:drupal:drupal:5.5:*:*:*:*:*:*:* cpe:2.3:a:drupal:drupal:6.0:*:*:*:*:*:*:* cpe:2.3:a:drupal:drupal:5.9:*:*:*:*:*:*:* cpe:2.3:a:drupal:drupal:5.8:*:*:*:*:*:*:* cpe:2.3:a:drupal:drupal:5.3:*:*:*:*:*:*:* cpe:2.3:a:drupal:drupal:6.3:*:*:*:*:*:*:* cpe:2.3:a:drupal:drupal:5.11:*:*:*:*:*:*:*

---

Published : 2009-02-19 03:30

Updated : 2017-08-17 01:29

---

NVD link : CVE-2008-6170

Mitre link : CVE-2008-6170

No products.

CWE-79