CVE-2009-0817: XSS
Cross-site scripting (XSS) vulnerability in the Protected Node module 5.x before 5.x-1.4 and 6.x before 6.x-1.5, a module for Drupal, allows remote authenticated users with "administer site configuration" permissions to inject arbitrary web script or HTML via the Password page info field, which is not properly handled by the protectednodeenterpassword function in protectednode.module.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Protected Node module (Drupal 5.x branch)to a version that resolves this vulnerability.Fixed in 5.x-1.4 - Upgrade
Upgrade
Protected Node module (Drupal 6.x branch)to a version that resolves this vulnerability.Fixed in 6.x-1.5 - Configuration
Revoke the "administer site configuration" permission from all roles except trusted site administrators to prevent remote authenticated users from exploiting the XSS via the Password page info field.
Drupal permissions administer site configuration = revoke from all non-administrative roles; grant only to trusted site administrators
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0817?
CVE-2009-0817 is classified as a high severity vulnerability due to its potential for cross-site scripting exploits.
How do I fix CVE-2009-0817?
To remediate CVE-2009-0817, update the Protected Node module to version 5.x-1.4 or 6.x-1.5 or newer.
Who is affected by CVE-2009-0817?
CVE-2009-0817 affects Drupal Protected Node module versions 5.x prior to 5.x-1.4 and 6.x prior to 6.x-1.5.
What kind of attacks can exploit CVE-2009-0817?
CVE-2009-0817 can be exploited for cross-site scripting attacks, allowing attackers to inject arbitrary web scripts.
Who can exploit CVE-2009-0817?
CVE-2009-0817 can be exploited by remote authenticated users who have 'administer site configuration' permissions.