Description

The Drupal filter_xss_admin function in 5.x before 5.8 and 6.x before 6.3 does not "prevent use of the object HTML tag in administrator input," which has unknown impact and attack vectors, probably related to an insufficient cross-site scripting (XSS) protection mechanism.

Remediation

References

CVE-2008-3219

Related Vulnerabilities

WordPress Plugin External Media Arbitrary File Upload (1.0.33)

WordPress Plugin WordPress Popular Posts TimThumb Arbitrary File Upload (2.1.4)

WordPress Plugin CF7 Invisible reCAPTCHA Cross-Site Request Forgery (1.3.3)

phpMyAdmin Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2010-3056)

IBM RTC Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-1893)

Severity

Medium

Classification

CVE-2008-3219 CWE-707

Tags

Missing Update Known Vulnerabilities