oss-sec mailing list archives
Re: CVE request: multiple drupal issues in < 6.3,5.8
From: "Steven M. Christey" <coley () linus mitre org>
Date: Fri, 18 Jul 2008 11:47:11 -0400 (EDT)
====================================================== Name: CVE-2008-3218 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3218 Reference: MLIST:[oss-security] 20080710 CVE request: multiple drupal issues in < 6.3,5.8 Reference: URL:http://www.openwall.com/lists/oss-security/2008/07/10/3 Reference: CONFIRM:http://drupal.org/node/280571 Multiple cross-site scripting (XSS) vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) free tagging taxonomy terms, which are not properly handled on node preview pages, and (2) unspecified OpenID values. ====================================================== Name: CVE-2008-3219 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3219 Reference: MLIST:[oss-security] 20080710 CVE request: multiple drupal issues in < 6.3,5.8 Reference: URL:http://www.openwall.com/lists/oss-security/2008/07/10/3 Reference: CONFIRM:http://drupal.org/node/280571 The Drupal filter_xss_admin function in 5.x before 5.8 and 6.x before 6.3 does not "prevent use of the object HTML tag in administrator input," which has unknown impact and attack vectors, probably related to an insufficient cross-site scripting (XSS) protection mechanism. ====================================================== Name: CVE-2008-3220 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3220 Reference: MLIST:[oss-security] 20080710 CVE request: multiple drupal issues in < 6.3,5.8 Reference: URL:http://www.openwall.com/lists/oss-security/2008/07/10/3 Reference: CONFIRM:http://drupal.org/node/280571 Cross-site request forgery (CSRF) vulnerability in Drupal 5.x before 5.8 and 6.x before 6.3 allows remote attackers to perform administrative actions via vectors involving deletion of "translated strings." ====================================================== Name: CVE-2008-3221 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3221 Reference: MLIST:[oss-security] 20080710 CVE request: multiple drupal issues in < 6.3,5.8 Reference: URL:http://www.openwall.com/lists/oss-security/2008/07/10/3 Reference: CONFIRM:http://drupal.org/node/280571 Cross-site request forgery (CSRF) vulnerability in Drupal 6.x before 6.3 allows remote attackers to perform administrative actions via vectors involving deletion of OpenID identities. ====================================================== Name: CVE-2008-3222 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3222 Reference: MLIST:[oss-security] 20080710 CVE request: multiple drupal issues in < 6.3,5.8 Reference: URL:http://www.openwall.com/lists/oss-security/2008/07/10/3 Reference: CONFIRM:http://drupal.org/node/280571 Session fixation vulnerability in Drupal 5.x before 5.8 and 6.x before 6.3, when contributed modules "terminate the current request during a login event," allows remote attackers to hijack web sessions via unknown vectors. ====================================================== Name: CVE-2008-3223 Status: Candidate URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3223 Reference: MLIST:[oss-security] 20080710 CVE request: multiple drupal issues in < 6.3,5.8 Reference: URL:http://www.openwall.com/lists/oss-security/2008/07/10/3 Reference: CONFIRM:http://drupal.org/node/280571 SQL injection vulnerability in the Schema API in Drupal 6.x before 6.3 allows remote attackers to execute arbitrary SQL commands via vectors related to "an inappropriate placeholder for 'numeric' fields."
Current thread:
- CVE request: multiple drupal issues in < 6.3,5.8 Hanno Böck (Jul 09)
- Re: CVE request: multiple drupal issues in < 6.3,5.8 Steven M. Christey (Jul 18)