« Volver al listado

CVE-2009-4296

Estado: ModificadaAlta (7.5)—

SQL injection vulnerability in the Taxonomy Timer module 5.x-1.8 and earlier and 6.x-alpha1 and earlier for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Brian Miller — Taxonomy Timer

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-4296",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-12-11T19:30:00.217",
  "references": [
    {
      "url": "http://drupal.org/node/641050",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://drupal.org/node/641064",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://drupal.org/node/649396",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/37573",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/37189",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2009/3388",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://drupal.org/node/641050",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://drupal.org/node/641064",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://drupal.org/node/649396",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/37573",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/37189",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2009/3388",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "SQL injection vulnerability in the Taxonomy Timer module 5.x-1.8 and earlier and 6.x-alpha1 and earlier for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de inyección SQL en el módulo Taxonomy Timer v5.x-1.8 y anteriores y v6.x-alpha1 v anteriores para Drupal  permite a atacantes remotos ejecutar comandos SQL arbitrarios a través de vectores sin especi"
    }
  ],
  "lastModified": "2026-06-16T23:13:23.230",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:brian_miller:taxonomy_timer:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "EFA1AAFB-EB95-4E9A-B4DC-087F0F4D26A8",
              "versionEndIncluding": "5.x-1.8"
            },
            {
              "criteria": "cpe:2.3:a:brian_miller:taxonomy_timer:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8E704921-D725-459E-AB79-AC0095D4010E",
              "versionEndIncluding": "6.x-1.0-alpha1"
            },
            {
              "criteria": "cpe:2.3:a:brian_miller:taxonomy_timer:5.x-0.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C3760002-F93A-41A9-876A-6467E4648B8B"
            },
            {
              "criteria": "cpe:2.3:a:brian_miller:taxonomy_timer:5.x-1.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "736122B5-2A44-41F9-B996-673EE859AE87"
            },
            {
              "criteria": "cpe:2.3:a:brian_miller:taxonomy_timer:5.x-1.0beta1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "95BF13BD-6A3D-4488-8E8F-3271B9CCB96F"
            },
            {
              "criteria": "cpe:2.3:a:brian_miller:taxonomy_timer:5.x-1.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C829AABB-1352-49EC-B1D1-85EEA50C670C"
            },
            {
              "criteria": "cpe:2.3:a:brian_miller:taxonomy_timer:5.x-1.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7ADCAD9D-5954-4681-8E15-74AA226E5F5D"
            },
            {
              "criteria": "cpe:2.3:a:brian_miller:taxonomy_timer:5.x-1.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "38B3A611-3126-44D7-883E-EE0B0FF3240F"
            },
            {
              "criteria": "cpe:2.3:a:brian_miller:taxonomy_timer:5.x-1.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5D9379FF-EAFD-4D11-BB35-19FCF1962BE3"
            },
            {
              "criteria": "cpe:2.3:a:brian_miller:taxonomy_timer:5.x-1.6:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "7F78A941-C332-44C2-A021-3C5502944149"
            },
            {
              "criteria": "cpe:2.3:a:brian_miller:taxonomy_timer:5.x-1.7:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "70636B92-5EDE-4957-9716-FFFAFA09351F"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "799CA80B-F3FA-4183-A791-2071A7DA1E54"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}