CVE-2009-2079: XSS
First published: Tue Jun 16 2009(Updated: )
Cross-site scripting (XSS) vulnerability in the administrative page interface in Taxonomy manager 5.x before 5.x-1.2 and 6.x before 6.x-1.1, a module for Drupal, allows remote authenticated users, with administer taxonomy privileges or the ability to use free tagging to add taxonomy terms, to inject arbitrary web script or HTML via (1) vocabulary names, (2) synonyms, and (3) term names.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Drupal Drupal | ||
| Drupal Taxonomy Manager | =5.x-1.0 | |
| Drupal Taxonomy Manager | =5.x-1.1 | |
| Drupal Taxonomy Manager | =6.x-1.0 | |
| Drupal Taxonomy Manager | =6.x-1.0-beta1 | |
| Drupal Taxonomy Manager | =6.x-1.0-beta2 | |
| All of | ||
| Drupal Drupal | ||
| Any of | ||
| Drupal Taxonomy Manager | =5.x-1.0 | |
| Drupal Taxonomy Manager | =5.x-1.1 | |
| Drupal Taxonomy Manager | =6.x-1.0 | |
| Drupal Taxonomy Manager | =6.x-1.0-beta1 | |
| Drupal Taxonomy Manager | =6.x-1.0-beta2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- collector/nvd-historical
- collector/nvd-index
- agent/references
- agent/type
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/remedy
- agent/last-modified-date
- agent/weakness
- agent/severity
- agent/author
- agent/description
- agent/event
- agent/softwarecombine
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/drupal
- canonical/drupal drupal
- canonical/drupal taxonomy manager
- version/drupal taxonomy manager/5.x-1.0
- version/drupal taxonomy manager/5.x-1.1
- version/drupal taxonomy manager/6.x-1.0
- version/drupal taxonomy manager/6.x-1.0-beta1
- version/drupal taxonomy manager/6.x-1.0-beta2