CVE-2009-2076

Drupal Views < 6.x-2.6 - Authenticated Cross-Site Scripting via Exposed Filters and View Name Parameter

Title source: llm

Description

Cross-site scripting (XSS) vulnerability in Views 6.x before 6.x-2.6, a module for Drupal, allows remote authenticated users to inject arbitrary web script or HTML via (1) exposed filters in the Views UI administrative interface and in the (2) view name parameter in the define custom views feature. NOTE: vector 2 is only exploitable by users with administer views permissions.

References (5)

Core 5

Core References

Exploit, URL Repurposed x_refsource_misc

http://lampsecurity.org/drupal-views-xss-vulnerability

Patch x_refsource_confirm

http://drupal.org/node/488082

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/35304

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/35425

Patch, Vendor Advisory x_refsource_confirm

http://drupal.org/node/488068

Scores

EPSS 0.0016

EPSS Percentile 36.0%

Details

CWE

CWE-79

Status published

Products (6)

drupal/views 6.x-2.0

drupal/views 6.x-2.1

drupal/views 6.x-2.2

drupal/views 6.x-2.3

drupal/views 6.x-2.4

drupal/views 6.x-2.5

Published Jun 16, 2009

Tracked Since Feb 18, 2026