CVE-2009-2076
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
Cross-site scripting (XSS) vulnerability in Views 6.x before 6.x-2.6, a module for Drupal, allows remote authenticated users to inject arbitrary web script or HTML via (1) exposed filters in the Views UI administrative interface and in the (2) view name parameter in the define custom views feature. NOTE: vector 2 is only exploitable by users with administer views permissions.
Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Views v6.x anteriores a v6.x-2.6, un modulo de Drupal, permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrariamente a través de (1) filtros que se muestran en la interfaz administrativa de usuario Views y el (2) parámetro "view name" en la característica de personalizar vistas. NOTA: vector 2 es únicamente explotable por usuarios con permisos administrativos de vistas.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2009-06-16 CVE Reserved
- 2009-06-16 CVE Published
- 2024-09-16 CVE Updated
- 2024-09-16 First Exploit
- 2024-09-17 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (5)
| URL | Tag | Source |
|---|---|---|
| http://www.securityfocus.com/bid/35304 | Vdb Entry |
| URL | Date | SRC |
|---|---|---|
| http://lampsecurity.org/drupal-views-xss-vulnerability | 2024-09-16 |
| URL | Date | SRC |
|---|---|---|
| http://drupal.org/node/488068 | 2024-02-14 | |
| http://drupal.org/node/488082 | 2024-02-14 |
| URL | Date | SRC |
|---|---|---|
| http://secunia.com/advisories/35425 | 2024-02-14 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Drupal Search vendor "Drupal" | Views Search vendor "Drupal" for product "Views" | 6.x-2.0 Search vendor "Drupal" for product "Views" and version "6.x-2.0" | - |
Affected
| in | Drupal Search vendor "Drupal" | Drupal Search vendor "Drupal" for product "Drupal" | * | - |
Safe
|
| Drupal Search vendor "Drupal" | Views Search vendor "Drupal" for product "Views" | 6.x-2.1 Search vendor "Drupal" for product "Views" and version "6.x-2.1" | - |
Affected
| in | Drupal Search vendor "Drupal" | Drupal Search vendor "Drupal" for product "Drupal" | * | - |
Safe
|
| Drupal Search vendor "Drupal" | Views Search vendor "Drupal" for product "Views" | 6.x-2.2 Search vendor "Drupal" for product "Views" and version "6.x-2.2" | - |
Affected
| in | Drupal Search vendor "Drupal" | Drupal Search vendor "Drupal" for product "Drupal" | * | - |
Safe
|
| Drupal Search vendor "Drupal" | Views Search vendor "Drupal" for product "Views" | 6.x-2.3 Search vendor "Drupal" for product "Views" and version "6.x-2.3" | - |
Affected
| in | Drupal Search vendor "Drupal" | Drupal Search vendor "Drupal" for product "Drupal" | * | - |
Safe
|
| Drupal Search vendor "Drupal" | Views Search vendor "Drupal" for product "Views" | 6.x-2.4 Search vendor "Drupal" for product "Views" and version "6.x-2.4" | - |
Affected
| in | Drupal Search vendor "Drupal" | Drupal Search vendor "Drupal" for product "Drupal" | * | - |
Safe
|
| Drupal Search vendor "Drupal" | Views Search vendor "Drupal" for product "Views" | 6.x-2.5 Search vendor "Drupal" for product "Views" and version "6.x-2.5" | - |
Affected
| in | Drupal Search vendor "Drupal" | Drupal Search vendor "Drupal" for product "Drupal" | * | - |
Safe
|