Vulnerability Bulletins |
SA-CORE-2009-005 - Drupal core - Cross site scripting |
|
| Affected software | Drupal |
|
Advisory ID: DRUPAL-SA-CORE-2009-005Project: Drupal coreVersion: 5.x, 6.xDate: 2009-April-29Security risk: Moderately criticalExploitable from: RemoteVulnerability: Cross site scriptingDescriptionWhen outputting user-supplied data Drupal strips potentially dangerous HTML attributes and tags or escapes characters which have a special meaning in HTML. This output filtering secures the site against cross site scripting attacks via user input.Certain byte sequences that are valid in the UTF-8 More info: https://www.drupal.org/node/449078 |
|