PT-2009-3244 · Drupal · Drupal Linkit Module+1

Publicado 2009-02-16 · Atualizado 2017-08-17 · CVE-2009-0603

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Drupal Link module version 5.x-2.5 for Drupal 5.10

Description A cross-site scripting (XSS) issue exists, allowing remote authenticated users with 'administer content types' privileges to inject arbitrary web script or HTML via the description parameter, also known as the Help field.

Recommendations For Drupal Link module version 5.x-2.5, avoid using the description parameter in the index.php file until a fix is available. As a temporary workaround, consider restricting access to the Link module for users with 'administer content types' privileges to minimize the risk of exploitation.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2009-0603

Produtos afetados

Drupal

Drupal Linkit Module

Referências · 7

• http://osvdb.org/51780 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0603 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-0603 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48553 · Nota
• http://securityfocus.com/bid/33642 · Nota
• http://secunia.com/advisories/33835 · Aviso do Fabricante
• http://archives.neohapsis.com/archives/fulldisclosure/2009-02/0036.html · Nota