Servers and applications
CVE-2008-3219
The Drupal filter_xss_admin function in 5.x before 5.8 and 6.x before 6.3 does not "prevent use of the object HTML tag in administrator input," which has unknown impact and attack vectors, probably related to an insufficient cross-site scripting (XSS) protection mechanism.
- Severity
- Medium 4.3
- Published
- 18 Jul 2008
- Last changed
- 16 Jun 2026
- Added to UpHeron
- 1 Nov 2026
- Fixed in
- 5.8, 6.3
- Exploit chance
- 2.1% in the next 30 daysHigher than 81% of CVEs. EPSS by FIRST, 12 Nov 2026
- Weakness
- Cross-site scripting (CWE-79)
- Attack
- Over the network · No login needed
- Attacker can
- Change some data
- CVSS vector
AV:N/AC:M/Au:N/C:N/I:P/A:N- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
DrupalServers and applications · cpe:a:drupal:drupal |
|