CVE-2008-6229: Cross-site scripting (XSS) vulnerability in the administrative interface in Drupal Content Construction Kit...

Security readout for executives and security teams

This is a stored XSS issue in the Drupal Content Construction Kit administrative interface. A user who already has "administer content" permission could place script or HTML in field labels or content-type names, affecting administrators or editors who view those pages. Exposure is most likely on legacy Drupal 5 or 6 sites still using vulnerable CCK releases, especially where multiple users hold "administer content" permission. Modern Drupal deployments are unlikely to be affected unless they retain old CCK code. Treat this as a legacy-platform hygiene issue unless vulnerable Drupal 5 or 6 systems remain in production. Prioritize remediation where untrusted or numerous users have content administration privileges. Mitigation focus: Upgrade CCK 5.x to 5.x-1.10 or later if still supported.; Upgrade CCK 6.x to 6.x-2.0 or later if still supported.; Restrict "administer content" permission to trusted administrators only..

Prepared

Jun 28, 2026, 11:23 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.