Vulnerability CVE-2009-2610


Published: 2009-07-27   Modified: 2012-02-13

Description:
Cross-site scripting (XSS) vulnerability in the Links Related module in the Links Package 5.x before 5.x-1.13 and 6.x before 6.x-1.2, a module for Drupal, allows remote authenticated users to inject arbitrary web script or HTML via the title field.

Type:

CWE-79

(Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'))

Vendor: Scott courtney
Product: Links package 
Version:
6.x-1.x-dev
6.x-1.1
6.x-1.0-beta7
6.x-1.0-beta6
6.x-1.0-beta5
6.x-1.0-beta3
6.x-1.0-beta2
6.x-1.0-beta15
6.x-1.0-beta14
6.x-1.0-beta13
6.x-1.0-beta12
6.x-1.0-beta11
6.x-1.0-beta10
6.x-1.0-beta1
6.x-1.0
5.x-1.x-dev
5.x-1.9
5.x-1.8
5.x-1.7
5.x-1.6
5.x-1.5
5.x-1.4
5.x-1.2
5.x-1.12-beta1
5.x-1.12
5.x-1.11

CVSS2 => (AV:N/AC:M/Au:S/C:N/I:P/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
3.5/10
2.9/10
6.8/10
Exploit range
Attack complexity
Authentication
Remote
Medium
Single time
Confidentiality impact
Integrity impact
Availability impact
None
Partial
None

 References:
http://drupal.org/node/502112
http://drupal.org/node/501360
http://drupal.org/node/501356
http://www.securityfocus.com/bid/35491
http://secunia.com/advisories/35557
http://osvdb.org/55326

Copyright 2019, cxsecurity.com

 

Back to Top