CVE-2008-3222: Medium severity drupal vulnerability
Published Jul 18, 2008
·Updated
Session fixation vulnerability in Drupal 5.x before 5.9 and 6.x before 6.3, when contributed modules "terminate the current request during a login event," allows remote attackers to hijack web sessions via unknown vectors.
Affected Software
4 affected components
Drupal Drupal>=6.0<6.3
Drupal Drupal>=5.0<5.9
fedoraproject fedora=9
fedoraproject fedora=8
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Jul 18, 2008
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2008-3222?
CVE-2008-3222 has a medium severity level due to its potential to allow session hijacking.
2
How do I fix CVE-2008-3222?
To fix CVE-2008-3222, upgrade Drupal to version 5.9 or 6.3 or later.
3
Who is affected by CVE-2008-3222?
CVE-2008-3222 affects Drupal versions 5.x prior to 5.9 and 6.x prior to 6.3.
4
What are the implications of CVE-2008-3222?
The implications of CVE-2008-3222 include potential session hijacking, which can lead to unauthorized access.
5
How can attackers exploit CVE-2008-3222?
Attackers can exploit CVE-2008-3222 by utilizing session fixation techniques during the login process.