CVE-2008-3218

Description

Multiple cross-site scripting (XSS) vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) free tagging taxonomy terms, which are not properly handled on node preview pages, and (2) unspecified OpenID values.

References

https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00551.html

https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00527.html

https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00016.html

https://exchange.xforce.ibmcloud.com/vulnerabilities/43704

https://bugzilla.redhat.com/show_bug.cgi?id=454849

http://www.securityfocus.com/bid/30168

http://www.openwall.com/lists/oss-security/2008/07/10/3

http://secunia.com/advisories/31079

http://drupal.org/node/280571

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3