CVE-2008-6972

Published: Aug 13, 2009Modified: Apr 23, 2026

3.5

Vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability: 6.8 / Impact: 2.9

Source: NVD

Description

Multiple cross-site scripting (XSS) vulnerabilities in Drupal Content Construction Kit (CCK) 5.x through 5.x-1.8 allow remote authenticated users with "administer content" permissions to inject arbitrary web script or HTML via the (1) "field label," (2) "help text," or (3) "allowed values" settings.

Affected (11)

Products: Karen Stevenson: Cck · Yves Chedemois: Cck

1 product

1 product

Configuration A

11 vulnerable · 1 platform

Vulnerable Software	Affected Versions
Karen Stevenson Cck	Version 5.x-1.0-beta
Karen Stevenson Cck	Version 5.x-1.1
Karen Stevenson Cck	Version 5.x-1.2
Karen Stevenson Cck	Version 5.x-1.3
Karen Stevenson Cck	Version 5.x-1.7
Karen Stevenson Cck	Version 5.x-1.x-dev
Yves Chedemois Cck	Version 5.x-1.4
Yves Chedemois Cck	Version 5.x-1.5
Yves Chedemois Cck	Version 5.x-1.6-1
Yves Chedemois Cck	Version 5.x-1.6
Yves Chedemois Cck	Version 5.x-1.8