CVE-2009-3915
Estado: ModificadaMedia (4.3)—
Gravedad4.3Media · CVSS 2.0
Probabilidad de explotación1.26 %mayor que el 69 % de las CVE
Explotación activaNono figura en el catálogo de CISA
Exploit públicoNo conocidosin código público localizado
Una vulnerabilidad de ejecución de secuencias de comandos en el formateador de separación de título y URL del módulo de Drupal "Link" v5.x antes de v5.x-2.6 y v6.x antes de v6.x-2.7, permite a atacantes remotos inyectar HTML o scripts web a través del campo de título del enlace.
CVSS
- Puntuación base
- 4.3
- Versión
- 2.0
- Vector
- AV:N/AC:M/Au:N/C:N/I:P/A:N
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 1.26 %
- Percentil entre todas las CVEs puntuadas
- 69
- Fecha de la puntuación
- 21/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-79
Referencias
Mostrar las 14 referencias
- http://drupal.org/node/620662
- http://drupal.org/node/620668
- http://drupal.org/node/623562
- http://osvdb.org/59672
- http://secunia.com/advisories/37289
- http://www.securityfocus.com/bid/36928
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54142
- http://drupal.org/node/620662
- http://drupal.org/node/620668
- http://drupal.org/node/623562
- http://osvdb.org/59672
- http://secunia.com/advisories/37289
- http://www.securityfocus.com/bid/36928
- https://exchange.xforce.ibmcloud.com/vulnerabilities/54142
JSON original (NVD)
Mostrar
{
"id": "CVE-2009-3915",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2009-11-09T17:30:00.813",
"references": [
{
"url": "http://drupal.org/node/620662",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://drupal.org/node/620668",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://drupal.org/node/623562",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://osvdb.org/59672",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/37289",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/36928",
"tags": [
"Patch"
],
"source": "cve@mitre.org"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/54142",
"source": "cve@mitre.org"
},
{
"url": "http://drupal.org/node/620662",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://drupal.org/node/620668",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://drupal.org/node/623562",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://osvdb.org/59672",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/37289",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/36928",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/54142",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the \"Separate title and URL\" formatter in the Link module 5.x before 5.x-2.6 and 6.x before 6.x-2.7, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via the link title field."
},
{
"lang": "es",
"value": "Una vulnerabilidad de ejecución de secuencias de comandos en el formateador de separación de título y URL del módulo de Drupal \"Link\" v5.x antes de v5.x-2.6 y v6.x antes de v6.x-2.7, permite a atacantes remotos inyectar HTML o scripts web a través del campo de título del enlace."
}
],
"lastModified": "2026-06-16T23:12:37.530",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "799CA80B-F3FA-4183-A791-2071A7DA1E54"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:john_c_fiala:link:5.x-1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5E701054-2FA8-45E3-B915-E0813B981A00"
},
{
"criteria": "cpe:2.3:a:john_c_fiala:link:5.x-1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AFD5126E-E2FD-4913-AE27-539A6D75A2C1"
},
{
"criteria": "cpe:2.3:a:john_c_fiala:link:5.x-1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "768B7161-6F7D-4D5A-9E0E-EE16B1774325"
},
{
"criteria": "cpe:2.3:a:john_c_fiala:link:5.x-1.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EC127D2F-F710-472D-A184-B321395EF5D5"
},
{
"criteria": "cpe:2.3:a:john_c_fiala:link:5.x-1.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2829A419-F652-4517-9B40-F03531114F9B"
},
{
"criteria": "cpe:2.3:a:john_c_fiala:link:5.x-1.x-dev:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5F6D9E47-BFE3-4311-B3AB-E56209F581E9"
},
{
"criteria": "cpe:2.3:a:john_c_fiala:link:5.x-2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B4AB5183-E598-4B57-BD6D-45FE18FA79AD"
},
{
"criteria": "cpe:2.3:a:john_c_fiala:link:5.x-2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "159B5A52-5047-4CC7-A7EC-CAB8E938EC83"
},
{
"criteria": "cpe:2.3:a:john_c_fiala:link:5.x-2.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CC981461-9F68-452F-9CC7-4D12D16C56D4"
},
{
"criteria": "cpe:2.3:a:john_c_fiala:link:5.x-2.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DD5BF1EE-C5F7-4B2D-BB57-207AF44FA88F"
},
{
"criteria": "cpe:2.3:a:john_c_fiala:link:5.x-2.3.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "90185CD5-84D6-4A9C-AD79-9B1170587D9C"
},
{
"criteria": "cpe:2.3:a:john_c_fiala:link:5.x-2.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3213B0A6-7738-4100-9C8E-68F66B3C1D43"
},
{
"criteria": "cpe:2.3:a:john_c_fiala:link:5.x-2.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2082B86D-7D03-4E17-8C3A-77AAD2C30DD7"
},
{
"criteria": "cpe:2.3:a:john_c_fiala:link:6.x-1.x-dev:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B5FC90E8-CDCE-4FE3-A191-DD734C8F1771"
},
{
"criteria": "cpe:2.3:a:john_c_fiala:link:6.x-2.1:beta1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4DEE1078-867F-4AFC-85B8-E58469CAF653"
},
{
"criteria": "cpe:2.3:a:john_c_fiala:link:6.x-2.1:beta2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "403F4813-3B26-4B88-838E-28C278B559B2"
},
{
"criteria": "cpe:2.3:a:john_c_fiala:link:6.x-2.1:beta3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7E5E2826-456E-4D9C-AD97-8E56951498A9"
},
{
"criteria": "cpe:2.3:a:john_c_fiala:link:6.x-2.1:beta4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FD7DFE78-14D9-4AFE-B760-A2BB9F37C554"
},
{
"criteria": "cpe:2.3:a:john_c_fiala:link:6.x-2.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D303C779-DCA3-4596-B107-EF3FCE378475"
},
{
"criteria": "cpe:2.3:a:john_c_fiala:link:6.x-2.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "27AC58F5-0FE0-4204-AADC-2EC50B1E6D7C"
},
{
"criteria": "cpe:2.3:a:john_c_fiala:link:6.x-2.3.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "46B21BCD-8B10-49C5-8BA8-34A2044FD78E"
},
{
"criteria": "cpe:2.3:a:john_c_fiala:link:6.x-2.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "7EE45B03-7FCF-40D5-8320-897E4718090E"
},
{
"criteria": "cpe:2.3:a:john_c_fiala:link:6.x-2.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "AA23A95C-F63A-4BC7-8D4F-32C177F85E84"
},
{
"criteria": "cpe:2.3:a:john_c_fiala:link:6.x-2.6:beta1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1620A01A-5980-42BE-9D1C-5F047CAEC48C"
},
{
"criteria": "cpe:2.3:a:john_c_fiala:link:6.x-2.6:beta2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A3D5E691-1E56-40A1-8007-5D04AF6D6079"
},
{
"criteria": "cpe:2.3:a:john_c_fiala:link:6.x-2.6:beta3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "C7CBEAED-08A4-4217-8A79-3958B449C575"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "cve@mitre.org"
}