Description

The Drupal.checkPlain function in Drupal 6.0 only escapes the first instance of a character in ECMAScript, which allows remote attackers to conduct cross-site scripting (XSS) attacks.

Remediation

References

CVE-2008-1133

Related Vulnerabilities

Cherokee Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2019-20799)

WordPress Plugin Woosaleskit Bar Cross-Site Scripting (1.0.0)

WordPress Plugin Backup and Restore WordPress-WPBackItUp Arbitrary File Deletion (1.15.3)

WordPress Plugin G-Lock Double Opt-in Manager 'ajaxbackend.php' SQL Injection (2.6.2)

Claroline Other Vulnerability (CVE-2006-1594)

Severity

Medium

Classification

CVE-2008-1133 CWE-707

Tags

Missing Update Known Vulnerabilities