PT-2009-3417 · Drupal · Taxonomy Theme

Publicado 2009-03-05 · Atualizado 2017-08-17 · CVE-2009-0818

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Taxonomy Theme module versions prior to 5.x-1.2

Description The issue allows remote authenticated users with the "administer taxonomy" permission, or the ability to create pages when tagging is enabled, to inject arbitrary web script or HTML via the name parameter to "index.php". This is due to a cross-site scripting (XSS) vulnerability in the taxonomy theme admin table builder function.

Recommendations For Taxonomy Theme module versions prior to 5.x-1.2, update to version 5.x-1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the taxonomy theme admin table builder function or limiting the ability to create pages when tagging is enabled. Avoid using the name parameter in the affected endpoint until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2009-0818

Produtos afetados

Taxonomy Theme

Referências · 7

• http://secunia.com/advisories/34080 · Aviso do Fabricante
• http://securityfocus.com/bid/33923 · Correção
• http://osvdb.org/52285 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-0818 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48979 · Nota
• http://drupal.org/node/386942 · Aviso do Fabricante
• http://drupal.org/node/386940 · Nota