PT-2009-4800 · Drupal · Drupal

Sumit Datta · Publicado 2009-07-08 · Atualizado 2021-04-21 · CVE-2009-2372

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Drupal versions 6.x before 6.13

Description The issue allows remote authenticated users to inject arbitrary web script, HTML, and possibly PHP code via a crafted user signature, because it does not prevent users from modifying user signatures after the associated comment format has been changed to an administrator-controlled input format.

Recommendations For versions 6.x before 6.13, update to version 6.13 or later to resolve the issue.

Correção

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

CVE-2009-2372

DSA-1930-1

Produtos afetados

Drupal

Referências · 6

• http://drupal.org/node/507572 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2372 · Nota
• http://securitytracker.com/id?1022497 · Correção
• http://secunia.com/advisories/35681 · Nota
• http://osvdb.org/55525 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-2372 · Nota de Segurança