CVE-2008-3219: XSS
First published: Fri Jul 18 2008(Updated: )
The Drupal filter_xss_admin function in 5.x before 5.8 and 6.x before 6.3 does not "prevent use of the object HTML tag in administrator input," which has unknown impact and attack vectors, probably related to an insufficient cross-site scripting (XSS) protection mechanism.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Drupal | >=5.0<5.8 | |
| Drupal | >=6.0<6.3 | |
| Fedora | =8 | |
| Fedora | =9 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2008/07/10/3
- http://drupal.org/node/280571
- http://www.securityfocus.com/bid/30168
- http://secunia.com/advisories/31079
- https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00551.html
- https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00016.html
- https://bugzilla.redhat.com/show_bug.cgi?id=454849
- https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00527.html
- https://exchange.xforce.ibmcloud.com/vulnerabilities/43701
Frequently Asked Questions
What is the severity of CVE-2008-3219?
CVE-2008-3219 is considered a moderate severity vulnerability due to its potential for cross-site scripting (XSS) exploits.
How do I fix CVE-2008-3219?
To fix CVE-2008-3219, upgrade Drupal to version 5.8 or later for 5.x, or to version 6.3 or later for 6.x.
Which versions of Drupal are affected by CVE-2008-3219?
CVE-2008-3219 affects Drupal versions prior to 5.8 in the 5.x series and versions prior to 6.3 in the 6.x series.
What can attackers exploit with CVE-2008-3219?
Attackers can exploit CVE-2008-3219 to execute arbitrary JavaScript code, leading to possible data theft or session hijacking through XSS.
Is CVE-2008-3219 still a concern for current Drupal installations?
CVE-2008-3219 is not a concern for current Drupal installations if they have been updated to the latest versions that address this vulnerability.
- agent/type
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/author
- agent/last-modified-date
- agent/references
- agent/description
- agent/event
- agent/first-publish-date
- agent/source
- agent/weakness
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-historical
- vendor/drupal
- canonical/drupal
- version/drupal/5.0
- version/drupal/6.0
- vendor/fedoraproject
- canonical/fedora
- version/fedora/8
- version/fedora/9