« Volver al listado

CVE-2009-0817

Estado: ModificadaBaja (3.5)—

Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en el módulo Protected Node v5.x anterior v5.x-1.4 y v6.x anterior a v6.x-1.5 para Drupal, permite a usuarios autenticados remotamente con permisos de "configuración administrativa del sitio", la inyección de secuencias de comandos web o HTML de su elección a través del campo Password Page Info, que no está manejado adecuadamente por la función protected_node_enterpassword en protected_node.module.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Drupal — Protected Node Module

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-0817",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-03-05T02:30:00.610",
  "references": [
    {
      "url": "http://drupal.org/node/385950",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://drupal.org/node/386604",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://drupal.org/node/386606",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://lampsecurity.org/node/28",
      "tags": [
        "Exploit",
        "URL Repurposed"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://osvdb.org/52300",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/34060",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2009/0572",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/48980",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://drupal.org/node/385950",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://drupal.org/node/386604",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://drupal.org/node/386606",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lampsecurity.org/node/28",
      "tags": [
        "Exploit",
        "URL Repurposed"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://osvdb.org/52300",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/34060",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2009/0572",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/48980",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in the Protected Node module 5.x before 5.x-1.4 and 6.x before 6.x-1.5, a module for Drupal, allows remote authenticated users with \"administer site configuration\" permissions to inject arbitrary web script or HTML via the Password page info field, which is not properly handled by the protected_node_enterpassword function in protected_node.module."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en el módulo Protected Node v5.x anterior v5.x-1.4 y v6.x anterior a  v6.x-1.5 para Drupal, permite a usuarios autenticados remotamente con permisos de \"configuración administrativa del sitio\", la inyección de secuencias de comandos web o HTML de su elección a través del campo Password Page Info, que no está manejado adecuadamente por la función protected_node_enterpassword  en protected_node.module."
    }
  ],
  "lastModified": "2026-06-16T23:05:52.597",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:drupal:protected_node_module:5.x:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CA409222-79A5-4C9D-8D79-5F634A61E0FC"
            },
            {
              "criteria": "cpe:2.3:a:drupal:protected_node_module:5.x-1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "63D34BF7-DDAE-4F29-93CD-503679FAAF24"
            },
            {
              "criteria": "cpe:2.3:a:drupal:protected_node_module:5.x-1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BEEE7794-247D-4303-A426-C68CD0F934AF"
            },
            {
              "criteria": "cpe:2.3:a:drupal:protected_node_module:5.x-1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8F817243-DF82-4B24-992C-6FA4CC0038C7"
            },
            {
              "criteria": "cpe:2.3:a:drupal:protected_node_module:5.x-1.x-dev:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A507F00C-8570-4265-86F4-CE13CD59F79D"
            },
            {
              "criteria": "cpe:2.3:a:drupal:protected_node_module:6.x-1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CF91738E-F092-4339-95C1-BA5696C3B935"
            },
            {
              "criteria": "cpe:2.3:a:drupal:protected_node_module:6.x-1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6AE752A2-612D-4E1D-9A6B-3D36CC009245"
            },
            {
              "criteria": "cpe:2.3:a:drupal:protected_node_module:6.x-1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "171053F8-66E2-4DA1-A54B-3C6D96488E50"
            },
            {
              "criteria": "cpe:2.3:a:drupal:protected_node_module:6.x-1.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9C785797-2B53-4799-9B52-07FCC418ADD4"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "799CA80B-F3FA-4183-A791-2071A7DA1E54"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}