CVE-2008-3222

Session fixation vulnerability in Drupal 5.x before 5.9 and 6.x before 6.3, when contributed modules "terminate the current request during a login event," allows remote attackers to hijack web sessions via unknown vectors.

• CWE-384

• http://drupal.org/node/280571Patch, Vendor Advisory
• http://drupal.org/node/286417Patch, Vendor Advisory
• http://secunia.com/advisories/31079Third Party Advisory
• http://secunia.com/advisories/31211Third Party Advisory
• http://www.openwall.com/lists/oss-security/2008/07/10/3Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/30168Patch, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/30359Patch, Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=454849Issue Tracking, Patch, Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43706Third Party Advisory, VDB Entry
• https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00016.htmlThird Party Advisory
• https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00527.htmlThird Party Advisory
• https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00551.htmlThird Party Advisory
• http://drupal.org/node/280571Patch, Vendor Advisory
• http://drupal.org/node/286417Patch, Vendor Advisory
• http://secunia.com/advisories/31079Third Party Advisory
• http://secunia.com/advisories/31211Third Party Advisory
• http://www.openwall.com/lists/oss-security/2008/07/10/3Mailing List, Third Party Advisory
• http://www.securityfocus.com/bid/30168Patch, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/30359Patch, Third Party Advisory, VDB Entry
• https://bugzilla.redhat.com/show_bug.cgi?id=454849Issue Tracking, Patch, Third Party Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/43706Third Party Advisory, VDB Entry
• https://www.redhat.com/archives/fedora-package-announce/2008-August/msg00016.htmlThird Party Advisory
• https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00527.htmlThird Party Advisory
• https://www.redhat.com/archives/fedora-package-announce/2008-July/msg00551.htmlThird Party Advisory

Published

Jul 18, 2008

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2008-3216The save function in br/prefmanager.d in projectl 1.001 crea…
• CVE-2008-3217PowerDNS Recursor before 3.1.6 does not always use the stron…
• CVE-2008-3218Multiple cross-site scripting (XSS) vulnerabilities in Drupa…
• CVE-2008-3219The Drupal filter_xss_admin function in 5.x before 5.8 and 6…
• CVE-2008-3220Cross-site request forgery (CSRF) vulnerability in Drupal 5.…
• CVE-2008-3221Cross-site request forgery (CSRF) vulnerability in Drupal 6.…
• CVE-2008-3223SQL injection vulnerability in the Schema API in Drupal 6.x …
• CVE-2008-3224Unspecified vulnerability in phpBB before 3.0.1 has unknown …
• CVE-2008-3225Joomla! before 1.5.4 allows attackers to access administrati…
• CVE-2008-3226The file caching implementation in Joomla! before 1.5.4 allo…
• CVE-2008-3227Unspecified vulnerability in Joomla! before 1.5.4 has unknow…
• CVE-2008-3228Joomla! before 1.5.4 does not configure .htaccess to apply c…