CVE-2008-3219

no score yetEPSS 2.1%

The Drupal filter_xss_admin function in 5.x before 5.8 and 6.x before 6.3 does not "prevent use of the object HTML tag in administrator input," which has unknown impact and attack vectors, probably related to an insufficient cross-site scripting (XSS) protection mechanism.

EPSS: 2.1% chance of exploitation in the next 30 days; higher than 81% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2008-07-18
Modified: 2026-06-16
Record from: the NVD, synced 2026-10-19

Affected

drupal:drupal
fedoraproject:fedora

References

http://drupal.org/node/280571
http://secunia.com/advisories/31079
http://www.openwall.com/lists/oss-security/2008/07/10/3
http://www.securityfocus.com/bid/30168
https://bugzilla.redhat.com/show_bug.cgi?id=454849

Check your stack JSON