« Volver al listado

CVE-2009-2076

Estado: ModificadaBaja (3.5)—

Cross-site scripting (XSS) vulnerability in Views 6.x before 6.x-2.6, a module for Drupal, allows remote authenticated users to inject arbitrary web script or HTML via (1) exposed filters in the Views UI administrative interface and in the (2) view name parameter in the define custom views feature. NOTE: vector 2 is only exploitable by users with administer views permissions.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Drupal — Views

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-2076",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-06-16T19:30:00.250",
  "references": [
    {
      "url": "http://drupal.org/node/488068",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://drupal.org/node/488082",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://lampsecurity.org/drupal-views-xss-vulnerability",
      "tags": [
        "Exploit",
        "URL Repurposed"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/35425",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/35304",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://drupal.org/node/488068",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://drupal.org/node/488082",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lampsecurity.org/drupal-views-xss-vulnerability",
      "tags": [
        "Exploit",
        "URL Repurposed"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/35425",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/35304",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in Views 6.x before 6.x-2.6, a module for Drupal, allows remote authenticated users to inject arbitrary web script or HTML via (1) exposed filters in the Views UI administrative interface and in the (2) view name parameter in the define custom views feature.  NOTE: vector 2 is only exploitable by users with administer views permissions."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Views v6.x anteriores a v6.x-2.6, un modulo de Drupal, permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrariamente a través de (1) filtros que se muestran en la interfaz administrativa de usuario Views y el (2) parámetro \"view name\" en la característica de personalizar vistas. NOTA: vector 2 es únicamente explotable por usuarios con permisos administrativos de vistas."
    }
  ],
  "lastModified": "2026-06-16T23:08:42.883",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:drupal:views:6.x-2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AB48B703-BFDC-4BC2-AADB-1D5877BD6F79"
            },
            {
              "criteria": "cpe:2.3:a:drupal:views:6.x-2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9D4CAFA5-CB7B-475B-9278-2C5576934FE7"
            },
            {
              "criteria": "cpe:2.3:a:drupal:views:6.x-2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "258F8CAF-E1A5-43D8-B515-4C5A5E541CC5"
            },
            {
              "criteria": "cpe:2.3:a:drupal:views:6.x-2.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E67C9A56-E67D-4517-8956-4354D62A506B"
            },
            {
              "criteria": "cpe:2.3:a:drupal:views:6.x-2.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8E28C97B-E461-4CC7-9751-EBF46B93F84F"
            },
            {
              "criteria": "cpe:2.3:a:drupal:views:6.x-2.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CBA2AF1A-C62A-4AEB-8704-E9671C9285E5"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "799CA80B-F3FA-4183-A791-2071A7DA1E54"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}