PT-2009-5925 · Drupal · Xml Sitemap Module

Publicado 2009-10-09 · Atualizado 2017-08-17 · CVE-2009-3653

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions XML Sitemap module for Drupal version 5.x-1.6

Description A cross-site scripting (XSS) issue exists in the additional links interface of the XML Sitemap module, allowing remote authenticated users with "administer site configuration" permission to inject arbitrary web script or HTML. This is related to the output of link paths.

Recommendations For XML Sitemap module for Drupal version 5.x-1.6, consider disabling the additional links interface until a patch is available to prevent exploitation. Restrict access to the module's configuration to minimize the risk of XSS injection. Avoid using the module's link path output feature in untrusted environments until the issue is resolved.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2009-3653

Produtos afetados

Xml Sitemap Module

Referências · 5

• http://securityfocus.com/bid/36556 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2009-3653 · Nota de Segurança
• http://drupal.org/node/591724 · Aviso do Fabricante
• http://drupal.org/node/591732 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53572 · Nota