PT-2009-6136 · Drupal · Link Module

Mr.Baileys · Publicado 2009-11-09 · Atualizado 2017-08-17 · CVE-2009-3915

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Link module versions 5.x before 5.x-2.6 Link module versions 6.x before 6.x-2.7

Description A cross-site scripting (XSS) issue exists in the "Separate title and URL" formatter of the Link module for Drupal. This allows remote attackers to inject arbitrary web script or HTML via the link title field.

Recommendations For Link module versions 5.x before 5.x-2.6, update to version 5.x-2.6 or later. For Link module versions 6.x before 6.x-2.7, update to version 6.x-2.7 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2009-3915

Produtos afetados

Link Module

Referências · 8

• http://drupal.org/node/620668 · Aviso do Fabricante
• http://drupal.org/node/623562 · Aviso do Fabricante
• http://osvdb.org/59672 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54142 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-3915 · Nota de Segurança
• http://securityfocus.com/bid/36928 · Correção
• http://secunia.com/advisories/37289 · Aviso do Fabricante
• http://drupal.org/node/620662 · Aviso do Fabricante