CVE-2008-3218

Description

Multiple cross-site scripting (XSS) vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) free tagging taxonomy terms, which are not properly handled on node preview pages, and (2) unspecified OpenID values.

References

http://www.openwall.com/lists/oss-security/2008/07/10/3

http://drupal.org/node/280571

http://www.securityfocus.com/bid/30168

https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00016.html

https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00527.html

http://secunia.com/advisories/31079

https://bugzilla.redhat.com/show_bug.cgi?id=454849

https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00551.html

https://exchange.xforce.ibmcloud.com/vulnerabilities/43704

Details

Risk Information

CVSS v2