CVE-2008-6170

Severity: low (CVSS 3.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-02-19 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in Drupal 5.x before 5.12 and 6.x before 6.6 allows remote authenticated users with create book content or edit node book hierarchy permissions to inject arbitrary web script or HTML via the book page title.

Affected products

Drupal: 5.0, 5.1, 5.2, 5.3, 5.4, 5.5 (+12)

References

http://drupal.org/node/324824
http://secunia.com/advisories/32297
http://secunia.com/advisories/32441
http://www.securityfocus.com/bid/31882
http://www.vupen.com/english/advisories/2008/2913
https://exchange.xforce.ibmcloud.com/vulnerabilities/46052
https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00783.html
https://www.redhat.com/archives/fedora-package-announce/2008-October/msg00826.html
http://drupal.org/node/324824
http://secunia.com/advisories/32297
http://secunia.com/advisories/32441
http://www.securityfocus.com/bid/31882

Get alerted when CVE-2008-6170 or the next vulnerability affects your stack