CVE-2009-0817
Status: ModifiedLow (3.5)—
Cross-site scripting (XSS) vulnerability in the Protected Node module 5.x before 5.x-1.4 and 6.x before 6.x-1.5, a module for Drupal, allows remote authenticated users with "administer site configuration" permissions to inject arbitrary web script or HTML via the Password page info field, which is not properly handled by the protected_node_enterpassword function in protected_node.module.
CVSS
- Version: 2.0
- Vector: AV:N/AC:M/Au:S/C:N/I:P/A:N
- Base score: 3.5
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 1.08%
- Percentile among all scored CVEs: 64
- Score date: 10/8/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
CWEs
- CWE-79
References
- http://drupal.org/node/385950
- http://drupal.org/node/386604
- http://drupal.org/node/386606
- http://lampsecurity.org/node/28
- http://osvdb.org/52300
- http://secunia.com/advisories/34060
- http://www.vupen.com/english/advisories/2009/0572
- https://exchange.xforce.ibmcloud.com/vulnerabilities/48980
- http://drupal.org/node/385950
- http://drupal.org/node/386604
- http://drupal.org/node/386606
- http://lampsecurity.org/node/28
- http://osvdb.org/52300
- http://secunia.com/advisories/34060
- http://www.vupen.com/english/advisories/2009/0572
- https://exchange.xforce.ibmcloud.com/vulnerabilities/48980
Raw JSON (NVD)
Show
{
"id": "CVE-2009-0817",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 3.5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
"authentication": "SINGLE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "LOW",
"obtainAllPrivilege": false,
"exploitabilityScore": 6.8,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2009-03-05T02:30:00.610",
"references": [
{
"url": "http://drupal.org/node/385950",
"tags": [
"Exploit",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://drupal.org/node/386604",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://drupal.org/node/386606",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://lampsecurity.org/node/28",
"tags": [
"Exploit",
"URL Repurposed"
],
"source": "cve@mitre.org"
},
{
"url": "http://osvdb.org/52300",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/34060",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.vupen.com/english/advisories/2009/0572",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/48980",
"source": "cve@mitre.org"
},
{
"url": "http://drupal.org/node/385950",
"tags": [
"Exploit",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://drupal.org/node/386604",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://drupal.org/node/386606",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://lampsecurity.org/node/28",
"tags": [
"Exploit",
"URL Repurposed"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://osvdb.org/52300",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/34060",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.vupen.com/english/advisories/2009/0572",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/48980",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Protected Node module 5.x before 5.x-1.4 and 6.x before 6.x-1.5, a module for Drupal, allows remote authenticated users with \"administer site configuration\" permissions to inject arbitrary web script or HTML via the Password page info field, which is not properly handled by the protected_node_enterpassword function in protected_node.module."
},
{
"lang": "es",
"value": "Vulnerabilidad de ejecución de secuencias de comandos en sitios cruzados (XSS) en el módulo Protected Node v5.x anterior v5.x-1.4 y v6.x anterior a v6.x-1.5 para Drupal, permite a usuarios autenticados remotamente con permisos de \"configuración administrativa del sitio\", la inyección de secuencias de comandos web o HTML de su elección a través del campo Password Page Info, que no está manejado adecuadamente por la función protected_node_enterpassword en protected_node.module."
}
],
"lastModified": "2026-06-16T23:05:52.597",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:drupal:protected_node_module:5.x:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CA409222-79A5-4C9D-8D79-5F634A61E0FC"
},
{
"criteria": "cpe:2.3:a:drupal:protected_node_module:5.x-1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "63D34BF7-DDAE-4F29-93CD-503679FAAF24"
},
{
"criteria": "cpe:2.3:a:drupal:protected_node_module:5.x-1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "BEEE7794-247D-4303-A426-C68CD0F934AF"
},
{
"criteria": "cpe:2.3:a:drupal:protected_node_module:5.x-1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8F817243-DF82-4B24-992C-6FA4CC0038C7"
},
{
"criteria": "cpe:2.3:a:drupal:protected_node_module:5.x-1.x-dev:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A507F00C-8570-4265-86F4-CE13CD59F79D"
},
{
"criteria": "cpe:2.3:a:drupal:protected_node_module:6.x-1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CF91738E-F092-4339-95C1-BA5696C3B935"
},
{
"criteria": "cpe:2.3:a:drupal:protected_node_module:6.x-1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6AE752A2-612D-4E1D-9A6B-3D36CC009245"
},
{
"criteria": "cpe:2.3:a:drupal:protected_node_module:6.x-1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "171053F8-66E2-4DA1-A54B-3C6D96488E50"
},
{
"criteria": "cpe:2.3:a:drupal:protected_node_module:6.x-1.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9C785797-2B53-4799-9B52-07FCC418ADD4"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "799CA80B-F3FA-4183-A791-2071A7DA1E54"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "cve@mitre.org"
}