« Back to list

CVE-2009-2076

Status: ModifiedLow (3.5)—

Cross-site scripting (XSS) vulnerability in Views 6.x before 6.x-2.6, a module for Drupal, allows remote authenticated users to inject arbitrary web script or HTML via (1) exposed filters in the Views UI administrative interface and in the (2) view name parameter in the define custom views feature. NOTE: vector 2 is only exploitable by users with administer views permissions.

CVSS

Exploitation probability (EPSS)

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

Affected technologies (1)

Drupal — Views

CWEs

References

Raw JSON (NVD)

Show
{
  "id": "CVE-2009-2076",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-06-16T19:30:00.250",
  "references": [
    {
      "url": "http://drupal.org/node/488068",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://drupal.org/node/488082",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://lampsecurity.org/drupal-views-xss-vulnerability",
      "tags": [
        "Exploit",
        "URL Repurposed"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/35425",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/35304",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://drupal.org/node/488068",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://drupal.org/node/488082",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://lampsecurity.org/drupal-views-xss-vulnerability",
      "tags": [
        "Exploit",
        "URL Repurposed"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://secunia.com/advisories/35425",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/35304",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-site scripting (XSS) vulnerability in Views 6.x before 6.x-2.6, a module for Drupal, allows remote authenticated users to inject arbitrary web script or HTML via (1) exposed filters in the Views UI administrative interface and in the (2) view name parameter in the define custom views feature.  NOTE: vector 2 is only exploitable by users with administer views permissions."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en Views v6.x anteriores a v6.x-2.6, un modulo de Drupal, permite a usuarios remotos autenticados inyectar secuencias de comandos web o HTML arbitrariamente a través de (1) filtros que se muestran en la interfaz administrativa de usuario Views y el (2) parámetro \"view name\" en la característica de personalizar vistas. NOTA: vector 2 es únicamente explotable por usuarios con permisos administrativos de vistas."
    }
  ],
  "lastModified": "2026-06-16T23:08:42.883",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:drupal:views:6.x-2.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AB48B703-BFDC-4BC2-AADB-1D5877BD6F79"
            },
            {
              "criteria": "cpe:2.3:a:drupal:views:6.x-2.1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "9D4CAFA5-CB7B-475B-9278-2C5576934FE7"
            },
            {
              "criteria": "cpe:2.3:a:drupal:views:6.x-2.2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "258F8CAF-E1A5-43D8-B515-4C5A5E541CC5"
            },
            {
              "criteria": "cpe:2.3:a:drupal:views:6.x-2.3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E67C9A56-E67D-4517-8956-4354D62A506B"
            },
            {
              "criteria": "cpe:2.3:a:drupal:views:6.x-2.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8E28C97B-E461-4CC7-9751-EBF46B93F84F"
            },
            {
              "criteria": "cpe:2.3:a:drupal:views:6.x-2.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CBA2AF1A-C62A-4AEB-8704-E9671C9285E5"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "799CA80B-F3FA-4183-A791-2071A7DA1E54"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}