PT-2009-5925 · Drupal · Xml Sitemap Module

Published 2009-10-09 · Updated 2017-08-17 · CVE-2009-3653

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions XML Sitemap module for Drupal version 5.x-1.6

Description A cross-site scripting (XSS) issue exists in the additional links interface of the XML Sitemap module, allowing remote authenticated users with "administer site configuration" permission to inject arbitrary web script or HTML. This is related to the output of link paths.

Recommendations For XML Sitemap module for Drupal version 5.x-1.6, consider disabling the additional links interface until a patch is available to prevent exploitation. Restrict access to the module's configuration to minimize the risk of XSS injection. Avoid using the module's link path output feature in untrusted environments until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-3653

Affected Products

Xml Sitemap Module

References · 5

• http://securityfocus.com/bid/36556 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2009-3653 · Security Note
• http://drupal.org/node/591724 · Vendor Advisory
• http://drupal.org/node/591732 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/53572 · Note