Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2008-3219: Drupal admin input may allow unsafe object tags
CVE-2008-3219 · published 18 years ago
Summary
The filter_xss_admin feature in Drupal 5 (versions before 5.8) and Drupal 6 (versions before 6.3) does not block the HTML <object> tag when administrators add content. This could let malicious code run in a web browser, potentially exposing the site to cross‑site scripting attacks. Update Drupal to the latest version or apply the provided security patch to restore proper protection.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| drupal | drupal |
>= 5.0, < 5.8 >= 6.0, < 6.3 cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:* |
| fedoraproject | fedora |
8 9 cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:* |
Original advisory text
The Drupal filter_xss_admin function in 5.x before 5.8 and 6.x before 6.3 does not "prevent use of the object HTML tag in administrator input," which has unknown impact and attack vectors, probably...
The Drupal filter_xss_admin function in 5.x before 5.8 and 6.x before 6.3 does not "prevent use of the object HTML tag in administrator input," which has unknown impact and attack vectors, probably related to an insufficient cross-site scripting (XSS) protection mechanism.
References
- http://drupal.org/node/280571 Patch Vendor Advisory
- http://secunia.com/advisories/31079 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2008/07/10/3 Mailing List Third Party Advisory
- http://www.securityfocus.com/bid/30168 Third Party Advisory VDB Entry
- https://bugzilla.redhat.com/show_bug.cgi?id=454849 Issue Tracking Patch Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/43701 Third Party Advisory VDB Entry
- https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00016.htm... Third Party Advisory
- https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00527.html Third Party Advisory
- https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00551.html Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker partial control (estimated)
Severity
4.3
Medium
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published18 Jul 2008
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2008-3219 · NVD
Track software like this
Free during beta