CVE-2008-3222: Session fixation vulnerability in Drupal 5.x before 5.9 and 6.x before 6.3, when contributed modules "termi...

Security readout for executives and security teams

Legacy Drupal 5 and 6 sites may be vulnerable to session hijacking when certain contributed modules interrupt login handling. In business terms, an attacker could potentially take over a user's authenticated web session. The public record does not name the exact attack vector, affected contributed modules, CVSS score, or active exploitation. Exposure is mainly legacy Drupal 5.x or 6.x deployments, especially internet-facing sites using contributed modules that alter or interrupt login flow. Modern supported Drupal versions are not identified as affected in the supplied sources. Prioritize any reachable legacy Drupal 5 or 6 site that handles authenticated users, admin access, customer data, or payment workflows. The issue is old, but session hijacking can create serious business impact where unpatched legacy systems remain online. Mitigation focus: Upgrade Drupal 5.x to 5.9 or later, if still maintained internally.; Upgrade Drupal 6.x to 6.3 or later, if still maintained internally.; Retire or isolate unsupported Drupal 5 and 6 systems where upgrade is impractical..

Prepared

Jun 28, 2026, 18:52 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.