Cross-site scripting (XSS) vulnerability in the administrative page interface in Taxonomy manager 5.x before 5.x-1.2 and 6.x before 6.x-1.1, a module for Drupal, allows remote authenticated users, with administer taxonomy privileges or the ability to use free tagging to add taxonomy terms, to inject arbitrary web script or HTML via (1) vocabulary names, (2) synonyms, and (3) term names.
References
Link | Resource |
---|---|
http://drupal.org/node/487602 | Patch |
http://drupal.org/node/487620 | Patch |
http://drupal.org/node/487818 | Patch Vendor Advisory |
http://lampsecurity.org/drupal-6-taxonomy-manager-xss-vulnerability | Exploit URL Repurposed |
http://secunia.com/advisories/35391 | Vendor Advisory |
http://www.securityfocus.com/bid/35286 |
Configurations
Configuration 1 (hide)
AND |
|
History
14 Feb 2024, 01:17
Type | Values Removed | Values Added |
---|---|---|
References | (MISC) http://lampsecurity.org/drupal-6-taxonomy-manager-xss-vulnerability - Exploit, URL Repurposed |
Information
Published : 2009-06-16 19:30
Updated : 2024-02-28 11:21
NVD link : CVE-2009-2079
Mitre link : CVE-2009-2079
CVE.ORG link : CVE-2009-2079
JSON object : View
Products Affected
drupal
- taxonomy_manager
- drupal
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')