VULNERABILITY INTELLIGENCE
CVE-2008-6171
CVSS score9.3 HIGH
EPSS probability3.71%
CISA KEVNot currently listed
Published2009-02-19
Last modified2026-06-16
CVSS vectorAV:N/AC:M/Au:N/C:C/I:C/A:C
Description
includes/bootstrap.inc in Drupal 5.x before 5.12 and 6.x before 6.6, when the server is configured for "IP-based virtual hosts," allows remote attackers to include and execute arbitrary files via the HTTP Host header.
Weakness classification
- CWE-20: Improper Input Validation