CVE-2009-0818: XSS
Cross-site scripting (XSS) vulnerability in the taxonomythemeadmintablebuilder function (taxonomythemeadmin.inc) in Taxonomy Theme module before 5.x-1.2, a module for Drupal, allows remote authenticated users with the "administer taxonomy" permission, or the ability to create pages when tagging is enabled, to inject arbitrary web script or HTML via the Vocabulary name (name parameter) to index.php. NOTE: some of these details are obtained from third party information.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
taxonomy_theme (Drupal module)to a version that resolves this vulnerability.Fixed in 5.x-1.2
Event History
Frequently Asked Questions
What is the severity of CVE-2009-0818?
CVE-2009-0818 has a medium severity rating due to the potential for remote authenticated users to perform cross-site scripting attacks.
How do I fix CVE-2009-0818?
To fix CVE-2009-0818, update the Taxonomy Theme module to version 5.x-1.2 or later.
Who is affected by CVE-2009-0818?
CVE-2009-0818 affects remote authenticated users with the 'administer taxonomy' permission in the Drupal Taxonomy Theme module.
What is the nature of the vulnerability described in CVE-2009-0818?
CVE-2009-0818 is a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts.
In which versions of Drupal is CVE-2009-0818 present?
CVE-2009-0818 is present in the Taxonomy Theme module versions prior to 5.x-1.2.