CVE-2008-1133
Published: 4 March 2008
The Drupal.checkPlain function in Drupal 6.0 only escapes the first instance of a character in ECMAScript, which allows remote attackers to conduct cross-site scripting (XSS) attacks.
Notes
Author | Note |
---|---|
jdstrand | drupal 6 |
Priority
Status
Package | Release | Status |
---|---|---|
drupal Launchpad, Ubuntu, Debian |
upstream |
Needs triage
|
dapper |
Not vulnerable
|
|
edgy |
Not vulnerable
|
|
feisty |
Not vulnerable
|
|
gutsy |
Does not exist
|
|
hardy |
Does not exist
|
|
drupal5 Launchpad, Ubuntu, Debian |
upstream |
Needs triage
|
dapper |
Does not exist
|
|
edgy |
Does not exist
|
|
feisty |
Does not exist
|
|
gutsy |
Not vulnerable
|
|
hardy |
Not vulnerable
|