CVE-2008-3219

The Drupal filter_xss_admin function in 5.x before 5.8 and 6.x before 6.3 does not "prevent use of the object HTML tag in administrator input," which has unknown impact and attack vectors, probably related to an insufficient cross-site scripting (XSS) protection mechanism.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.openwall.com/lists/oss-security/2008/07/10/3	Mailing List Third Party Advisory
http://drupal.org/node/280571	Patch Vendor Advisory
http://www.securityfocus.com/bid/30168	Third Party Advisory VDB Entry
http://secunia.com/advisories/31079	Third Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00551.html	Third Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00016.html	Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=454849	Issue Tracking Patch Third Party Advisory
https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00527.html	Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/43701	Third Party Advisory VDB Entry

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:drupal:drupal::::::::
	cpe:2.3:a:drupal:drupal::::::::

Configuration 2 (hide)

OR	cpe:2.3:o:fedoraproject:fedora:8:::::::*
	cpe:2.3:o:fedoraproject:fedora:9:::::::*

Information

Published : 2008-07-18 09:41

Updated : 2021-04-15 06:49

NVD link : CVE-2008-3219

Mitre link : CVE-2008-3219

JSON object : View

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Advertisement

Products Affected

drupal

drupal

fedoraproject

fedora

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.openwall.com/lists/oss-security/2008/07/10/3", "name": "[oss-security] 20080710 CVE request: multiple drupal issues in < 6.3,5.8", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MLIST"}, {"url": "http://drupal.org/node/280571", "name": "http://drupal.org/node/280571", "tags": ["Patch", "Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://www.securityfocus.com/bid/30168", "name": "30168", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BID"}, {"url": "http://secunia.com/advisories/31079", "name": "31079", "tags": ["Third Party Advisory"], "refsource": "SECUNIA"}, {"url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00551.html", "name": "FEDORA-2008-6411", "tags": ["Third Party Advisory"], "refsource": "FEDORA"}, {"url": "https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00016.html", "name": "FEDORA-2008-6916", "tags": ["Third Party Advisory"], "refsource": "FEDORA"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=454849", "name": "https://bugzilla.redhat.com/show_bug.cgi?id=454849", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00527.html", "name": "FEDORA-2008-6415", "tags": ["Third Party Advisory"], "refsource": "FEDORA"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/43701", "name": "openid-unspecified-xss(43701)", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The Drupal filter_xss_admin function in 5.x before 5.8 and 6.x before 6.3 does not \"prevent use of the object HTML tag in administrator input,\" which has unknown impact and attack vectors, probably related to an insufficient cross-site scripting (XSS) protection mechanism."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-79"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2008-3219", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "acInsufInfo": false, "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2008-07-18T16:41Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "5.8", "versionStartIncluding": "5.0"}, {"cpe23Uri": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "6.3", "versionStartIncluding": "6.0"}]}, {"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:9:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2021-04-15T13:49Z"}