Vulnerability Bulletins |
SA-2008-006 - Drupal core - Cross site scripting (UTF8) |
|
| Affected software | Drupal |
|
Advisory ID: DRUPAL-SA-2008-006Project: Drupal coreVersion: 4.7.x, 5.xDate: 2008-January-10Security risk: Moderately criticalExploitable from: RemoteVulnerability: Cross site scriptingDescriptionWhen outputting plaintext Drupal strips potentially dangerous HTML tags and attributes from HTML, and escapes characters which have a special meaning in HTML. This output filtering secures the site against cross site scripting attacks via user input.Certain byte sequences that are invalid in the UTF8 More info: https://www.drupal.org/node/208564 |
|