CVE-2008-3218

Vulnerability

Drupal 6.x versions prior to 6.3 are affected by two cross-site scripting (XSS) issues. First, free tagging taxonomy terms are not properly sanitized on node preview pages, allowing injection of arbitrary script or HTML. Second, unspecified OpenID values from providers are output without escaping, enabling XSS when a user interacts with malicious OpenID providers. [1][4]

Exploitation

For the taxonomy XSS, an attacker must entice a victim to select a crafted term containing malicious code and then preview the node. For the OpenID XSS, a malicious OpenID provider can inject script into user pages when the victim uses that provider. Both require user interaction (previewing a node or using a malicious OpenID provider). [4]

Impact

Successful exploitation allows remote attackers to inject arbitrary web script or HTML in the context of the victim's session, potentially leading to data theft, session hijacking, or other malicious actions. [1]

Mitigation

The vulnerabilities are fixed in Drupal 6.3, released July 9, 2008. Users should upgrade to Drupal 6.3 or later. Fedora packages were updated to drupal-6.3-1.fc9 and drupal-5.8-1.fc8. [2][3][4]