CVE-2009-2079

Опубликовано: 16 июн. 2009

Источник: nvd

CVSS2: 3.5

EPSS Низкий

Описание

Cross-site scripting (XSS) vulnerability in the administrative page interface in Taxonomy manager 5.x before 5.x-1.2 and 6.x before 6.x-1.1, a module for Drupal, allows remote authenticated users, with administer taxonomy privileges or the ability to use free tagging to add taxonomy terms, to inject arbitrary web script or HTML via (1) vocabulary names, (2) synonyms, and (3) term names.

Ссылки

http://drupal.org/node/487602
Patch
http://drupal.org/node/487620
Patch
http://drupal.org/node/487818
Patch
Vendor Advisory
http://lampsecurity.org/drupal-6-taxonomy-manager-xss-vulnerability
Exploit
URL Repurposed
http://secunia.com/advisories/35391
Vendor Advisory
http://www.securityfocus.com/bid/35286
http://drupal.org/node/487602
Patch
http://drupal.org/node/487620
Patch
http://drupal.org/node/487818
Patch
Vendor Advisory
http://lampsecurity.org/drupal-6-taxonomy-manager-xss-vulnerability
Exploit
URL Repurposed
http://secunia.com/advisories/35391
Vendor Advisory
http://www.securityfocus.com/bid/35286

Уязвимые конфигурации

Конфигурация 1

Одновременно

cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*

Одно из

cpe:2.3:a:drupal:taxonomy_manager:5.x-1.0:*:*:*:*:*:*:*

cpe:2.3:a:drupal:taxonomy_manager:5.x-1.1:*:*:*:*:*:*:*

cpe:2.3:a:drupal:taxonomy_manager:6.x-1.0:*:*:*:*:*:*:*

cpe:2.3:a:drupal:taxonomy_manager:6.x-1.0-beta1:*:*:*:*:*:*:*

cpe:2.3:a:drupal:taxonomy_manager:6.x-1.0-beta2:*:*:*:*:*:*:*

EPSS

Процентиль: 49%

0.00262

Низкий

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

GHSA-jxcr-5w4r-w9w4

github

около 3 лет назад