PT-2009-6493 · Drupal · Drupal Core

Publicado 2009-12-21 · Atualizado 2017-08-17 · CVE-2009-4371

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Drupal Core versions 6.14 through 6.15

Description A cross-site scripting (XSS) issue exists in the Locale module, allowing remote authenticated users with administer languages permissions to inject arbitrary web script or HTML via the Language name in English or Native language name fields in the Custom language form.

Recommendations For versions 6.14 through 6.15, update to a version that includes a fix for this issue to prevent exploitation. As a temporary workaround, consider restricting access to the Custom language form for users with administer languages permissions until a patch is available. Avoid using the Language name in English and Native language name fields in the affected form until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2009-4371

Produtos afetados

Drupal Core

Referências · 5

• 🔥 http://madirish.net/?article=442 · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4371 · Nota
• http://secunia.com/advisories/37825 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/54873 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-4371 · Nota de Segurança