PT-2009-3417 · Drupal · Taxonomy Theme

Published 2009-03-05 · Updated 2017-08-17 · CVE-2009-0818

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Taxonomy Theme module versions prior to 5.x-1.2

Description The issue allows remote authenticated users with the "administer taxonomy" permission, or the ability to create pages when tagging is enabled, to inject arbitrary web script or HTML via the name parameter to "index.php". This is due to a cross-site scripting (XSS) vulnerability in the taxonomy theme admin table builder function.

Recommendations For Taxonomy Theme module versions prior to 5.x-1.2, update to version 5.x-1.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the taxonomy theme admin table builder function or limiting the ability to create pages when tagging is enabled. Avoid using the name parameter in the affected endpoint until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-0818

Affected Products

Taxonomy Theme

References · 7

• http://secunia.com/advisories/34080 · Vendor Advisory
• http://securityfocus.com/bid/33923 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-0818 · Security Note
• http://drupal.org/node/386942 · Vendor Advisory
• http://osvdb.org/52285 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48979 · Note
• http://drupal.org/node/386940 · Note