PT-2009-3244 · Drupal · Drupal Linkit Module+1

Published 2009-02-16 · Updated 2017-08-17 · CVE-2009-0603

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Drupal Link module version 5.x-2.5 for Drupal 5.10

Description A cross-site scripting (XSS) issue exists, allowing remote authenticated users with 'administer content types' privileges to inject arbitrary web script or HTML via the description parameter, also known as the Help field.

Recommendations For Drupal Link module version 5.x-2.5, avoid using the description parameter in the index.php file until a fix is available. As a temporary workaround, consider restricting access to the Link module for users with 'administer content types' privileges to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-0603

Affected Products

Drupal

Drupal Linkit Module

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2009-0603 · Security Note
• http://secunia.com/advisories/33835 · Vendor Advisory
• http://osvdb.org/51780 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-0603 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48553 · Note
• http://securityfocus.com/bid/33642 · Note
• http://archives.neohapsis.com/archives/fulldisclosure/2009-02/0036.html · Note