Description

The private filesystem in Drupal 5.x before 5.10 and 6.x before 6.4 trusts the MIME type sent by a web browser, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks by uploading files containing arbitrary web script or HTML.

Remediation

References

CVE-2008-3741

Related Vulnerabilities

WordPress Plugin Ninja Forms with File Uploads Extension Cross-Site Scripting (3.3.12)

GlassFish Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2017-1000028)

Drupal Permissions, Privileges, and Access Controls Vulnerability (CVE-2008-4789)

WordPress Plugin Livefyre Comments 3 Cross-Site Scripting (4.1.4)

WordPress Plugin WP e-Commerce-Store Toolkit Privilege Escalation (2.0)

Severity

Low

Classification

CVE-2008-3741 CWE-707

Tags

Missing Update Known Vulnerabilities