Vulnerability Name:

CVE-2008-0273 (CCN-39619)

Assigned:2008-01-10
Published:2008-01-10
Updated:2017-08-08
Summary:Interpretation conflict in Drupal 4.7.x before 4.7.11 and 5.x before 5.6, when Internet Explorer 6 is used, allows remote attackers to conduct cross-site scripting (XSS) attacks via invalid UTF-8 byte sequences, which are not processed as UTF-8 by Drupal's HTML filtering, but are processed as UTF-8 by Internet Explorer, effectively removing characters from the document and defeating the HTML protection mechanism.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-79
Vulnerability Consequences:Gain Access
References:Source: MITRE
Type: CNA
CVE-2008-0273

Source: CCN
Type: DRUPAL-SA-2008-006
Drupal core - Cross site scripting (UTF8)

Source: CONFIRM
Type: UNKNOWN
http://drupal.org/node/208564

Source: CCN
Type: SA28422
Drupal Multiple Vulnerabilities

Source: SECUNIA
Type: Patch
28422

Source: CCN
Type: SA28486
vbDrupal Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
28486

Source: CCN
Type: OSVDB ID: 42164
Drupal Browser Interpretation Conflict (MSIE 6) UTF-8 XSS

Source: BID
Type: Patch
27238

Source: CCN
Type: BID-27238
Drupal Prior To 4.7.11 and 5.6 Multiple Remote Vulnerabilities

Source: CONFIRM
Type: UNKNOWN
http://www.vbdrupal.org/forum/showthread.php?p=6878

Source: CONFIRM
Type: UNKNOWN
http://www.vbdrupal.org/forum/showthread.php?t=1349

Source: VUPEN
Type: UNKNOWN
ADV-2008-0127

Source: VUPEN
Type: UNKNOWN
ADV-2008-0134

Source: XF
Type: UNKNOWN
drupal-utf8-xss(39619)

Source: XF
Type: UNKNOWN
drupal-utf8-xss(39619)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:drupal:drupal:4.0.0:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.1.0:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.2.0_rc:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.4:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.4.1:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.4.2:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.4.3:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.5:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.5.1:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.5.2:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.5.3:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.5.4:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.5.5:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.5.6:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.5.7:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.5.8:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.6:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.6.1:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.6.2:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.6.3:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.6.4:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.6.5:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.6.6:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.6.7:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.6.8:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.6.9:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.6.10:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.6.11:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.7:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.7.1:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.7.2:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.7.3:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.7.4:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.7.5:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.7.6:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.7.7:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.7.8:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.7.9:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.7.10:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.7_rev_1.2:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:4.7_rev_1.15:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:5.0:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:5.1:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:5.1_rev1.1:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:5.2:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:5.3:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:5.4:*:*:*:*:*:*:*
  • OR cpe:/a:drupal:drupal:5.5:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    drupal drupal 4.0.0
    drupal drupal 4.1.0
    drupal drupal 4.2.0_rc
    drupal drupal 4.4
    drupal drupal 4.4.1
    drupal drupal 4.4.2
    drupal drupal 4.4.3
    drupal drupal 4.5
    drupal drupal 4.5.1
    drupal drupal 4.5.2
    drupal drupal 4.5.3
    drupal drupal 4.5.4
    drupal drupal 4.5.5
    drupal drupal 4.5.6
    drupal drupal 4.5.7
    drupal drupal 4.5.8
    drupal drupal 4.6
    drupal drupal 4.6.1
    drupal drupal 4.6.2
    drupal drupal 4.6.3
    drupal drupal 4.6.4
    drupal drupal 4.6.5
    drupal drupal 4.6.6
    drupal drupal 4.6.7
    drupal drupal 4.6.8
    drupal drupal 4.6.9
    drupal drupal 4.6.10
    drupal drupal 4.6.11
    drupal drupal 4.7
    drupal drupal 4.7.1
    drupal drupal 4.7.2
    drupal drupal 4.7.3
    drupal drupal 4.7.4
    drupal drupal 4.7.5
    drupal drupal 4.7.6
    drupal drupal 4.7.7
    drupal drupal 4.7.8
    drupal drupal 4.7.9
    drupal drupal 4.7.10
    drupal drupal 4.7_rev_1.2
    drupal drupal 4.7_rev_1.15
    drupal drupal 5.0
    drupal drupal 5.1
    drupal drupal 5.1_rev1.1
    drupal drupal 5.2
    drupal drupal 5.3
    drupal drupal 5.4
    drupal drupal 5.5.