CVE-2009-2076

{"id": "CVE-2009-2076", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2009-06-16T19:30:00.250", "references": [{"url": "http://drupal.org/node/488068", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://drupal.org/node/488082", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://lampsecurity.org/drupal-views-xss-vulnerability", "tags": ["Exploit", "URL Repurposed"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/35425", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/35304", "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in Views 6.x before 6.x-2.6, a module for Drupal, allows remote authenticated users to inject arbitrary web script or HTML via (1) exposed filters in the Views UI administrative interface and in the (2) view name parameter in the define custom views feature. NOTE: vector 2 is only exploitable by users with administer views permissions."}, {"lang": "es", "value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Views v6.x anteriores a v6.x-2.6, un modulo de Drupal, permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrariamente a trav\u00e9s de (1) filtros que se muestran en la interfaz administrativa de usuario Views y el (2) par\u00e1metro \"view name\" en la caracter\u00edstica de personalizar vistas. NOTA: vector 2 es \u00fanicamente explotable por usuarios con permisos administrativos de vistas."}], "lastModified": "2024-02-14T01:17:43.863", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:drupal:views:6.x-2.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "AB48B703-BFDC-4BC2-AADB-1D5877BD6F79"}, {"criteria": "cpe:2.3:a:drupal:views:6.x-2.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9D4CAFA5-CB7B-475B-9278-2C5576934FE7"}, {"criteria": "cpe:2.3:a:drupal:views:6.x-2.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "258F8CAF-E1A5-43D8-B515-4C5A5E541CC5"}, {"criteria": "cpe:2.3:a:drupal:views:6.x-2.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E67C9A56-E67D-4517-8956-4354D62A506B"}, {"criteria": "cpe:2.3:a:drupal:views:6.x-2.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8E28C97B-E461-4CC7-9751-EBF46B93F84F"}, {"criteria": "cpe:2.3:a:drupal:views:6.x-2.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CBA2AF1A-C62A-4AEB-8704-E9671C9285E5"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "799CA80B-F3FA-4183-A791-2071A7DA1E54"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}