CVEvulnerability
CVE-2009-0817
3.5 LOW
Official page ↗
- Status
- Modified
- Published
- 2009-03-05
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Cross-site scripting (XSS) vulnerability in the Protected Node module 5.x before 5.x-1.4 and 6.x before 6.x-1.5, a module for Drupal, allows remote authenticated users with "administer site configuration" permissions to inject arbitrary web script or HTML via the Password page info field, which is not properly handled by the protected_node_enterpassword function in protected_node.module.
Affected configurations
• drupal protected node module 5.x
• drupal protected node module 5.x-1.0
• drupal protected node module 5.x-1.2
• drupal protected node module 5.x-1.3
• drupal protected node module 5.x-1.x-dev
• drupal protected node module 6.x-1.0
• drupal protected node module 6.x-1.2
• drupal protected node module 6.x-1.3
• drupal protected node module 6.x-1.4
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- http://drupal.org/node/385950 Exploit, Vendor Advisory
- http://drupal.org/node/386604 Patch, Vendor Advisory
- http://drupal.org/node/386606 Patch, Vendor Advisory
- http://lampsecurity.org/node/28 Exploit, URL Repurposed
- http://osvdb.org/52300 osvdb.org
- http://secunia.com/advisories/34060 Vendor Advisory
- http://www.vupen.com/english/advisories/2009/0572 Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/48980 exchange.xforce.ibmcloud.com
- http://drupal.org/node/385950 Exploit, Vendor Advisory
- http://drupal.org/node/386604 Patch, Vendor Advisory
- http://drupal.org/node/386606 Patch, Vendor Advisory
- http://lampsecurity.org/node/28 Exploit, URL Repurposed
- http://osvdb.org/52300 osvdb.org
- http://secunia.com/advisories/34060 Vendor Advisory
- http://www.vupen.com/english/advisories/2009/0572 Patch, Vendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/48980 exchange.xforce.ibmcloud.com