CVE-2008-3222

2008-07-1816:41:00

CWE-384

[email protected]

web.nvd.nist.gov

CVSS2

5.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:P/A:N

AI Score

6.4

Confidence

Low

EPSS

0.005

Percentile

75.9%

JSON

Session fixation vulnerability in Drupal 5.x before 5.9 and 6.x before 6.3, when contributed modules “terminate the current request during a login event,” allows remote attackers to hijack web sessions via unknown vectors.

Affected configurations

Nvd

Node

drupaldrupalRange5.0–5.9

drupaldrupalRange6.0–6.3

Node

fedoraprojectfedoraMatch8

fedoraprojectfedoraMatch9

VendorProductVersionCPE
drupaldrupal*cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*
fedoraprojectfedora8cpe:2.3:o:fedoraproject:fedora:8:*:*:*:*:*:*:*
fedoraprojectfedora9cpe:2.3:o:fedoraproject:fedora:9:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
drupal	drupal	*	cpe:2.3:a:drupal:drupal::::::::
fedoraproject	fedora	8	cpe:2.3:o:fedoraproject:fedora:8:::::::*
fedoraproject	fedora	9	cpe:2.3:o:fedoraproject:fedora:9:::::::*