CVE-2008-3219

MediumCVSS 4.3/10Last modified Jun 16, 2026

Description

The Drupal filter_xss_admin function in 5.x before 5.8 and 6.x before 6.3 does not "prevent use of the object HTML tag in administrator input," which has unknown impact and attack vectors, probably related to an insufficient cross-site scripting (XSS) protection mechanism.

Metrics

CVSS 2.0 4.3/10AV:N/AC:M/Au:N/C:N/I:P/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://drupal.org/node/280571Patch, Vendor Advisory
http://secunia.com/advisories/31079Third Party Advisory
http://www.openwall.com/lists/oss-security/2008/07/10/3Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/30168Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=454849Issue Tracking, Patch, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/43701Third Party Advisory, VDB Entry
https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00016.htmlThird Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00527.htmlThird Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00551.htmlThird Party Advisory
http://drupal.org/node/280571Patch, Vendor Advisory
http://secunia.com/advisories/31079Third Party Advisory
http://www.openwall.com/lists/oss-security/2008/07/10/3Mailing List, Third Party Advisory
http://www.securityfocus.com/bid/30168Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=454849Issue Tracking, Patch, Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/43701Third Party Advisory, VDB Entry
https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00016.htmlThird Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00527.htmlThird Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00551.htmlThird Party Advisory

Timeline

Published: Jul 18, 2008
Last modified: Jun 16, 2026
NVD status: Modified

Related CVEs from 2008

CVE-2008-32204.3Cross-site request forgery (CSRF) vulnerability in Drupal 5.x before 5.8 and 6.x before 6.3 allows remote attackers to perform administrativ CVE-2008-32214.3Cross-site request forgery (CSRF) vulnerability in Drupal 6.x before 6.3 allows remote attackers to perform administrative actions via vecto CVE-2008-32225.8Session fixation vulnerability in Drupal 5.x before 5.9 and 6.x before 6.3, when contributed modules "terminate the current request during a CVE-2008-32237.5SQL injection vulnerability in the Schema API in Drupal 6.x before 6.3 allows remote attackers to execute arbitrary SQL commands via vectors CVE-2008-322410.0Unspecified vulnerability in phpBB before 3.0.1 has unknown impact and attack vectors related to "urls gone through redirect() being used wi CVE-2008-322510.0Joomla! before 1.5.4 allows attackers to access administration functionality, which has unknown impact and attack vectors related to a missi CVE-2008-32265.0The file caching implementation in Joomla! before 1.5.4 allows attackers to access cached pages via unknown attack vectors.CVE-2008-32277.5Unspecified vulnerability in Joomla! before 1.5.4 has unknown impact and attack vectors related to a "User Redirect Spam fix," possibly an o CVE-2008-32287.5Joomla! before 1.5.4 does not configure .htaccess to apply certain security checks that "block common exploits" to SEF URLs, which has unkno CVE-2008-32296.9Stack-based buffer overflow in op before Changeset 563, when xauth support is enabled, allows local users to gain privileges via a long XAUT CVE-2008-32301.9The ffmpeg lavf demuxer allows user-assisted attackers to cause a denial of service (application crash) via a crafted GIF file, possibly rel CVE-2008-32314.3xine-lib before 1.1.15 allows remote attackers to cause a denial of service (crash) via a crafted OGG file, as demonstrated by playing lol-f