CVE-2009-3653

Cross-site scripting (XSS) vulnerability in the additional links interface in XML Sitemap 5.x-1.6, a module for Drupal, allows remote authenticated users, with "administer site configuration" permission, to inject arbitrary web script or HTML via unspecified vectors, related to link path output.

CVSS v2.0 3.5 LOW

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://drupal.org/node/591724	Patch Vendor Advisory
http://drupal.org/node/591732	Patch Vendor Advisory
http://www.securityfocus.com/bid/36556	Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/53572

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:darren_oh:xml_sitemap:5.x-1.6:*:*:*:*:*:*:*

cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2009-10-09 14:30

Updated : 2017-08-17 01:31

NVD link : CVE-2009-3653

Mitre link : CVE-2009-3653

CVE.ORG link : CVE-2009-3653

JSON object : View

Products Affected

darren_oh

xml_sitemap

drupal

drupal

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2009-3653", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2009-10-09T14:30:00.547", "references": [{"url": "http://drupal.org/node/591724", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://drupal.org/node/591732", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/36556", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/53572", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in the additional links interface in XML Sitemap 5.x-1.6, a module for Drupal, allows remote authenticated users, with \"administer site configuration\" permission, to inject arbitrary web script or HTML via unspecified vectors, related to link path output."}, {"lang": "es", "value": "Vulnerabilidad de Ejecuci\u00f3n de secuencias de comandos en sitios cruzados(XSS) en la interfaz \"enlaces adicionales\" en el modulo de Drupal \"XML Sitemap\" v5.x-1.6, permite inyectar HTML o scripts web a usuarios remotos autenticados con el permiso \"administrar la configuraci\u00f3n del sitio\", a trav\u00e9s de vectores no especificados relacionados con la ruta de enlace de salida."}], "lastModified": "2017-08-17T01:31:13.727", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:darren_oh:xml_sitemap:5.x-1.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2AADA67F-6B98-4B7E-86F0-FE4426F610D1"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "799CA80B-F3FA-4183-A791-2071A7DA1E54"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}