Description

The private filesystem in Drupal 5.x before 5.10 and 6.x before 6.4 trusts the MIME type sent by a web browser, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks by uploading files containing arbitrary web script or HTML.

Remediation

References

CVE-2008-3741

Related Vulnerabilities

WordPress Plugin BitMonet Cross-Site Scripting (1.0)

osCommerce Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2002-1991)

WordPress Plugin Image Hover Effects Ultimate (Image Gallery, Effects, Lightbox, Comparison or Magnifier) Security Bypass (9.6.1)

WordPress Plugin Popup Modal For Youtube Cross-Site Scripting (1.0.1)

Jenkins DEPRECATED: Code Vulnerability (CVE-2016-3721)

Severity

Low

Classification

CVE-2008-3741 CWE-707

Tags

Missing Update Known Vulnerabilities