FKIE_CVE-2008-0273

Vulnerability from fkie_nvd - Published: 2008-01-15 20:00 - Updated: 2026-06-16 22:49
Severity
Summary
Interpretation conflict in Drupal 4.7.x before 4.7.11 and 5.x before 5.6, when Internet Explorer 6 is used, allows remote attackers to conduct cross-site scripting (XSS) attacks via invalid UTF-8 byte sequences, which are not processed as UTF-8 by Drupal's HTML filtering, but are processed as UTF-8 by Internet Explorer, effectively removing characters from the document and defeating the HTML protection mechanism.
References
cve@mitre.orghttp://drupal.org/node/208564
cve@mitre.orghttp://secunia.com/advisories/28422Patch
cve@mitre.orghttp://secunia.com/advisories/28486
cve@mitre.orghttp://www.securityfocus.com/bid/27238Patch
cve@mitre.orghttp://www.vbdrupal.org/forum/showthread.php?p=6878
cve@mitre.orghttp://www.vbdrupal.org/forum/showthread.php?t=1349
cve@mitre.orghttp://www.vupen.com/english/advisories/2008/0127
cve@mitre.orghttp://www.vupen.com/english/advisories/2008/0134
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/39619
af854a3a-2127-422b-91ae-364da2661108http://drupal.org/node/208564
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/28422Patch
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/28486
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/27238Patch
af854a3a-2127-422b-91ae-364da2661108http://www.vbdrupal.org/forum/showthread.php?p=6878
af854a3a-2127-422b-91ae-364da2661108http://www.vbdrupal.org/forum/showthread.php?t=1349
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2008/0127
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2008/0134
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/39619
Impacted products
Vendor Product Version
drupal drupal 4.0.0
drupal drupal 4.1.0
drupal drupal 4.2.0_rc
drupal drupal 4.4
drupal drupal 4.4.1
drupal drupal 4.4.2
drupal drupal 4.4.3
drupal drupal 4.5
drupal drupal 4.5.1
drupal drupal 4.5.2
drupal drupal 4.5.3
drupal drupal 4.5.4
drupal drupal 4.5.5
drupal drupal 4.5.6
drupal drupal 4.5.7
drupal drupal 4.5.8
drupal drupal 4.6
drupal drupal 4.6.1
drupal drupal 4.6.2
drupal drupal 4.6.3
drupal drupal 4.6.4
drupal drupal 4.6.5
drupal drupal 4.6.6
drupal drupal 4.6.7
drupal drupal 4.6.8
drupal drupal 4.6.9
drupal drupal 4.6.10
drupal drupal 4.6.11
drupal drupal 4.7
drupal drupal 4.7.1
drupal drupal 4.7.2
drupal drupal 4.7.3
drupal drupal 4.7.4
drupal drupal 4.7.5
drupal drupal 4.7.6
drupal drupal 4.7.7
drupal drupal 4.7.8
drupal drupal 4.7.9
drupal drupal 4.7.10
drupal drupal 4.7_rev_1.2
drupal drupal 4.7_rev_1.15
drupal drupal 5.0
drupal drupal 5.1
drupal drupal 5.1_rev1.1
drupal drupal 5.2
drupal drupal 5.3
drupal drupal 5.4
drupal drupal 5.5.
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.0.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "E0CA1165-C304-48FA-9676-08EC5284C847",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.1.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "C008BB7D-05AB-47B3-B020-C5C39B0FD03F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.2.0_rc:*:*:*:*:*:*:*",
              "matchCriteriaId": "94444F9F-858A-4040-BE97-8A92B84DA7B4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "E51CCF47-FC19-44A1-A843-034227AC0ABF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "AA805CAF-A678-43A9-932D-EE35DBCCA793",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.4.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "18331C39-0ACE-4651-9D9F-1533AAD7C58C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.4.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "439C861D-7612-4E6A-8D9D-F04043DA9298",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "1BD40E38-71BA-42AD-BEBB-D4AD05ADDF6A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "82317650-F136-446D-904D-354B4D26E91B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.5.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "06A1ACAF-A468-43F0-9FAD-FA3D48363843",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.5.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "A68656D9-3EA0-4749-AF1B-2F9B485A02ED",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.5.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "BFEDAA48-3F53-4B13-BB6A-CDC63E3922A5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.5.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "F6946291-0F27-4666-95C8-E744800D3EFB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.5.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "79713A65-5A3A-4682-8A49-614174AB7C6F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.5.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "4E42FFA3-6FAE-4764-AF83-F544E6BA6CA7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.5.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "7456EEFF-15B8-4A75-B10E-AF936B4AD347",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "46D3F002-92E8-4CBB-8A1D-F8BCD2F782E4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.6.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "FC5ACB7E-0CEB-4417-839A-8B06615FC981",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.6.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "35BD7D35-AA9D-4589-A6BC-6D34219B7128",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.6.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "611B9D43-CE88-4451-A27C-7F6F24016B4F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.6.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "AD1A7208-6273-4CC6-AB7B-DA855EEF2729",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.6.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "83457EB5-BA6B-4ECB-8CB2-A10989B3A9F9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.6.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "49A92C9C-18DD-4FF7-A95D-72EE72C83C0E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.6.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "3DC016B5-A4C2-4A78-B830-C041C8BAAD76",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.6.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "35B99C22-9A8C-43F3-9AD8-D901D07D5FCD",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.6.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "EB94DAC5-F0E1-4427-98E4-A5684BF3F408",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.6.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "AAB80759-1441-46B0-937B-848EF327CB6E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.6.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "6F6F8EE5-CECC-4B35-AAD4-8152DBF51605",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "FFE9A8A9-19D4-4C50-A4B5-2EFD8B05BAE8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.7.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "79F8FEEF-6857-4DC8-9D0D-76D801D0E914",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.7.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "61EC4ECE-6719-4C54-B150-017ACB32E644",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.7.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "1D5368BD-60AC-49E7-80D4-A5B317319A31",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.7.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "DC3B1D3A-B449-4F4A-9405-4B5FC9041974",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.7.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "228039D8-A41B-4D04-8084-40E13941659F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.7.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "550F4476-9749-4DE8-8ACF-C17FD4D82466",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.7.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "B281B2AC-1F20-4330-826B-B733BD6A88D4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.7.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "D17799AB-2A2F-41FE-92DF-0AEDEF63CB2B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.7.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "9E563D8F-2F1F-4B81-99F3-67879D658367",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.7.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "FA0B551D-175A-4CE6-A955-1035DBF933FE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.7_rev_1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "8D91A74D-6AD6-42A7-B7CF-EC06D47DE465",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:4.7_rev_1.15:*:*:*:*:*:*:*",
              "matchCriteriaId": "88EB827F-99C1-429D-AABA-F7CD94CF2835",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:5.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "BDBE79A6-5762-4A7C-8FDA-C11FFFDCFC9B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:5.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "A5BCAB7B-DF79-4DB8-A5C4-731F251A02A2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:5.1_rev1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "87BF63E1-FB1A-4D76-BF0D-F07267127504",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:5.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "E5AEAB73-F7A9-4C62-BCB6-1028DAF149DB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:5.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "FF34F79B-6B1B-45CA-82BA-24D4254B26DF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:5.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "1C4C5857-3690-4D74-B135-B6AB7E766FB7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:drupal:drupal:5.5.:*:*:*:*:*:*:*",
              "matchCriteriaId": "698B4A81-4A20-4BD8-B0E5-3335B7DC190C",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Interpretation conflict in Drupal 4.7.x before 4.7.11 and 5.x before 5.6, when Internet Explorer 6 is used, allows remote attackers to conduct cross-site scripting (XSS) attacks via invalid UTF-8 byte sequences, which are not processed as UTF-8 by Drupal\u0027s HTML filtering, but are processed as UTF-8 by Internet Explorer, effectively removing characters from the document and defeating the HTML protection mechanism."
    },
    {
      "lang": "es",
      "value": "Conflicto de interpretaci\u00f3n en Drupal 4.7.x anterior a 4.7.11 y 5.x anterior a 5.6, cuando se utiliza Internet Explorer 6, permite a atacantes remotos llevar a cabo ataques de secuencias de comandos en sitios cruzados a trav\u00e9s de secuencias de bytes UTF-8 no v\u00e1lidas, las cuales no son procesadas como UTF-8 por el filtro HTML de Drupal, pero son procesadas por UTF-8 por el Internet Explorer, eliminando los caracteres del documento HTML y derrotando el mecanismo de protecci\u00f3n."
    }
  ],
  "id": "CVE-2008-0273",
  "lastModified": "2026-06-16T22:49:17.860",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "NONE",
          "baseScore": 4.3,
          "confidentialityImpact": "NONE",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 2.9,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ]
  },
  "published": "2008-01-15T20:00:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://drupal.org/node/208564"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://secunia.com/advisories/28422"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/28486"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/27238"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vbdrupal.org/forum/showthread.php?p=6878"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vbdrupal.org/forum/showthread.php?t=1349"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2008/0127"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2008/0134"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39619"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://drupal.org/node/208564"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://secunia.com/advisories/28422"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/28486"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch"
      ],
      "url": "http://www.securityfocus.com/bid/27238"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vbdrupal.org/forum/showthread.php?p=6878"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vbdrupal.org/forum/showthread.php?t=1349"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2008/0127"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2008/0134"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/39619"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.