CVE-2009-2372: Code Injection
Drupal 6.x before 6.13 does not prevent users from modifying user signatures after the associated comment format has been changed to an administrator-controlled input format, which allows remote authenticated users to inject arbitrary web script, HTML, and possibly PHP code via a crafted user signature.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-2372?
CVE-2009-2372 has a moderate severity rating due to user-controlled input leading to potential script injection.
How do I fix CVE-2009-2372?
To fix CVE-2009-2372, update your Drupal installation to version 6.13 or later.
Who is affected by CVE-2009-2372?
CVE-2009-2372 affects users of Drupal 6.x versions prior to 6.13.
What type of attacks can be executed due to CVE-2009-2372?
CVE-2009-2372 allows remote authenticated users to inject arbitrary web script, HTML, and possibly PHP code.
Is the exploitation of CVE-2009-2372 easy to execute?
Exploitation of CVE-2009-2372 is relatively straightforward for remote authenticated users with access to modify signatures.