CVE-2008-6533

Vulnerability

In Drupal 5.x before version 5.13 and 6.x before version 6.7, when an input format is deleted, the system does not delete or update all related content that was created using that format [1]. Consequently, that content continues to be displayed without the filtering previously provided by the deleted format, which can allow malicious tags to be output unsanitized [1].

Exploitation

An attacker who has previously submitted content (e.g., a comment or node) with harmful HTML tags while a permissive input format was active can have that content subsequently rendered unfiltered after the format is deleted [1]. No additional authentication beyond the original content submission is required; the attack vector is remote and relies on the deletion event occurring after the malicious content was posted [1].

Impact

Successful exploitation leads to cross-site scripting (XSS) [1]. An attacker can inject arbitrary scripts or HTML that will be executed in the browsers of users viewing the affected content, potentially leading to session hijacking, credential theft, or other client-side attacks [1].

Mitigation

Upgrade to Drupal 5.13 or Drupal 6.7, released on 2008-December-10 [1]. If immediate upgrade is not possible, apply the provided patches (SA-2008-073-5.12.patch for Drupal 5.12 or SA-2008-073-6.6.patch for Drupal 6.6) as a temporary measure [1]. No other workarounds are documented in the reference.