PT-2009-4536 · Drupal · Taxonomy Manager

Justin Klein Keane + 1 · Published 2009-06-16 · Updated 2024-02-14 · CVE-2009-2083

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Taxonomy manager versions 5.x before 5.x-1.2

Description A cross-site scripting (XSS) issue exists in the term data detail page of the Taxonomy manager module for Drupal. This allows remote authenticated users with specific privileges to inject arbitrary web script or HTML via the "Parent and related terms" field.

Recommendations For Taxonomy manager versions 5.x before 5.x-1.2, update to version 5.x-1.2 or later to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-2083

Affected Products

Taxonomy Manager

References · 6

• 🔥 http://lampsecurity.org/drupal-6-taxonomy-manager-xss-vulnerability · Exploit
• http://secunia.com/advisories/35391 · Vendor Advisory
• http://drupal.org/node/487818 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-2083 · Security Note
• http://drupal.org/node/487620 · Vendor Advisory
• http://securityfocus.com/bid/35286 · Note