PT-2009-4800 · Drupal · Drupal

Sumit Datta · Published 2009-07-08 · Updated 2021-04-21 · CVE-2009-2372

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Drupal versions 6.x before 6.13

Description The issue allows remote authenticated users to inject arbitrary web script, HTML, and possibly PHP code via a crafted user signature, because it does not prevent users from modifying user signatures after the associated comment format has been changed to an administrator-controlled input format.

Recommendations For versions 6.x before 6.13, update to version 6.13 or later to resolve the issue.

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2009-2372

DSA-1930-1

Affected Products

Drupal

References · 6

• http://drupal.org/node/507572 · Vendor Advisory
• http://securitytracker.com/id?1022497 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-2372 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2372 · Note
• http://secunia.com/advisories/35681 · Note
• http://osvdb.org/55525 · Note