CVE-2009-4369

Опубликовано: 21 дек. 2009

Источник: nvd

CVSS2: 3.5

EPSS Низкий

Описание

Cross-site scripting (XSS) vulnerability in the Contact module (modules/contact/contact.admin.inc or modules/contact/contact.module) in Drupal Core 5.x before 5.21 and 6.x before 6.15 allows remote authenticated users with "administer site-wide contact form" permissions to inject arbitrary web script or HTML via the contact category name.

Ссылки

http://drupal.org/files/sa-core-2009-009/SA-CORE-2009-009-6.14.patch
Exploit
http://drupal.org/node/661586
Patch
Vendor Advisory
http://secunia.com/advisories/37815
Vendor Advisory
http://secunia.com/advisories/37824
Vendor Advisory
http://www.madirish.net/?article=441
Exploit
Patch
http://www.securityfocus.com/bid/37372
https://exchange.xforce.ibmcloud.com/vulnerabilities/54867
http://drupal.org/files/sa-core-2009-009/SA-CORE-2009-009-6.14.patch
Exploit
http://drupal.org/node/661586
Patch
Vendor Advisory
http://secunia.com/advisories/37815
Vendor Advisory
http://secunia.com/advisories/37824
Vendor Advisory
http://www.madirish.net/?article=441
Exploit
Patch
http://www.securityfocus.com/bid/37372
https://exchange.xforce.ibmcloud.com/vulnerabilities/54867

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:drupal:drupal:5.0:*:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:5.0:beta1:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:5.0:beta2:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:5.0:rc1:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:5.0:rc2:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:5.1:*:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:5.2:*:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:5.4:*:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:5.5:*:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:5.6:*:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:5.7:*:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:5.8:*:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:5.9:*:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:5.10:*:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:5.11:*:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:5.12:*:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:5.13:*:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:5.14:*:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:5.15:*:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:5.16:*:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:5.17:*:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:5.18:*:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:5.19:*:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:5.20:*:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:5.x:dev:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:6.0:*:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:6.0:beta1:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:6.0:beta2:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:6.0:beta3:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:6.0:beta4:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:6.0:rc-1:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:6.0:rc-2:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:6.0:rc-3:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:6.0:rc-4:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:6.1:*:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:6.2:*:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:6.3:*:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:6.4:*:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:6.5:*:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:6.6:*:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:6.7:*:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:6.8:*:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:6.9:*:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:6.10:*:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:6.11:*:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:6.12:*:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:6.13:*:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:6.14:*:*:*:*:*:*:*

EPSS

Процентиль: 49%

0.00256

Низкий

3.5 Low

CVSS2

Дефекты

CWE-79

Связанные уязвимости

CVE-2009-4369

ubuntu

больше 15 лет назад

CVE-2009-4369

debian

больше 15 лет назад

Cross-site scripting (XSS) vulnerability in the Contact module (module ...

GHSA-3rm3-gj9m-589h

github

около 3 лет назад

EPSS

Процентиль: 49%

0.00256

Низкий

3.5 Low

CVSS2

Дефекты

CWE-79