CVE-2008-3222
published 2008-07-18CVE-2008-3222: Session fixation vulnerability in Drupal 5.x before 5.9 and 6.x before 6.3, when contributed modules "terminate the current request during a login event,"…
PriorityP425medium5.8CVSS 2.0
AVNACMAuNCPIPAN
EPSS
2.89%
85.5th percentile
Session fixation vulnerability in Drupal 5.x before 5.9 and 6.x before 6.3, when contributed modules "terminate the current request during a login event," allows remote attackers to hijack web sessions via unknown vectors.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| drupal | drupal | >= 5.0 < 5.9 | 5.9 |
| drupal | drupal | >= 6.0 < 6.3 | 6.3 |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
CVSS provenance
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-qvqj-pfj9-vcvw: Session fixation vulnerability in Drupal 5
ghsa_unreviewed·2022-05-01
CVE-2008-3222 [MEDIUM] CWE-384 GHSA-qvqj-pfj9-vcvw: Session fixation vulnerability in Drupal 5
Session fixation vulnerability in Drupal 5.x before 5.9 and 6.x before 6.3, when contributed modules "terminate the current request during a login event," allows remote attackers to hijack web sessions via unknown vectors.
Red Hat
drupal: multiple security issues in < 6.3,5.8/5.9 (SA-2008-044,SA-2008-046 - CVE-2008-3218, CVE-2008-3219, CVE-2008-3220, CVE-2008-3221, CVE-2008-3222, CVE-2008-3223)
vendor_redhat·CVSS 4.3
CVE-2008-3218 [MEDIUM] drupal: multiple security issues in < 6.3,5.8/5.9 (SA-2008-044,SA-2008-046 - CVE-2008-3218, CVE-2008-3219, CVE-2008-3220, CVE-2008-3221, CVE-2008-3222, CVE-2008-3223)
drupal: multiple security issues in < 6.3,5.8/5.9 (SA-2008-044,SA-2008-046 - CVE-2008-3218, CVE-2008-3219, CVE-2008-3220, CVE-2008-3221, CVE-2008-3222, CVE-2008-3223)
Multiple cross-site scripting (XSS) vulnerabilities in Drupal 6.x before 6.3 allow remote attackers to inject arbitrary web script or HTML via vectors related to (1) free tagging taxonomy terms, which are not properly handled on node preview pages, and (2) unspecified OpenID values.
No detection rules found.
No public exploits indexed.
http://drupal.org/node/280571http://drupal.org/node/286417http://secunia.com/advisories/31079http://secunia.com/advisories/31211http://www.openwall.com/lists/oss-security/2008/07/10/3http://www.securityfocus.com/bid/30168http://www.securityfocus.com/bid/30359https://bugzilla.redhat.com/show_bug.cgi?id=454849https://exchange.xforce.ibmcloud.com/vulnerabilities/43706https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00016.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-July/msg00527.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-July/msg00551.htmlhttp://drupal.org/node/280571http://drupal.org/node/286417http://secunia.com/advisories/31079http://secunia.com/advisories/31211http://www.openwall.com/lists/oss-security/2008/07/10/3http://www.securityfocus.com/bid/30168http://www.securityfocus.com/bid/30359https://bugzilla.redhat.com/show_bug.cgi?id=454849https://exchange.xforce.ibmcloud.com/vulnerabilities/43706https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00016.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-July/msg00527.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-July/msg00551.html
2008-07-18
Published