Unrated severityNVD Advisory· Published Feb 19, 2009· Updated Jun 16, 2026
CVE-2008-6171
CVE-2008-6171
Description
includes/bootstrap.inc in Drupal 5.x before 5.12 and 6.x before 6.6, when the server is configured for "IP-based virtual hosts," allows remote attackers to include and execute arbitrary files via the HTTP Host header.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
19cpe:2.3:a:drupal:drupal:5.0:*:*:*:*:*:*:*+ 18 more
- cpe:2.3:a:drupal:drupal:5.0:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:5.1:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:5.10:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:5.11:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:5.2:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:5.3:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:5.4:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:5.5:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:5.6:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:5.7:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:5.8:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:5.9:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.0:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.1:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.2:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.3:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.4:*:*:*:*:*:*:*
- cpe:2.3:a:drupal:drupal:6.5:*:*:*:*:*:*:*
- (no CPE)range: <5.12, <6.6
Patches
Vulnerability mechanics
References
9- drupal.org/node/324824nvdPatchVendor Advisory
- drupal.org/files/sa-2008-067/SA-2008-067-5.11.patchnvd
- secunia.com/advisories/32389nvd
- secunia.com/advisories/32441nvd
- www.securityfocus.com/bid/31900nvd
- www.vupen.com/english/advisories/2008/2913nvd
- exchange.xforce.ibmcloud.com/vulnerabilities/46049nvd
- www.redhat.com/archives/fedora-package-announce/2008-October/msg00783.htmlnvd
- www.redhat.com/archives/fedora-package-announce/2008-October/msg00826.htmlnvd
News mentions
0No linked articles in our index yet.