CVE-2008-3218

NameCVE-2008-3218
DescriptionMultiple cross-site scripting (XSS) vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) free tagging taxonomy terms, which are not properly handled on node preview pages, and (2) unspecified OpenID values.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
drupal-4.7source(unstable)(not affected)
drupal5source(unstable)(not affected)

Notes

- drupal5 <not-affected> (Vulnerable code not present, feature introduced in 6.0)
- drupal-4.7 <not-affected> (Vulnerable code not present, feature introduced in 6.0)
Search for package or bug name: Reporting problems