Unscored severity · published Jun 16, 2009
CVE-2009-2076
Cross-site scripting (XSS) vulnerability in Views 6.x before 6.x-2.6, a module for Drupal, allows remote authenticated users to inject arbitrary web script or HTML via (1) exposed…
–
CVSS
0.9%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in Views 6.x before 6.x-2.6, a module for Drupal, allows remote authenticated users to inject arbitrary web script or HTML via (1) exposed filters in the Views UI administrative interface and in the (2) view name parameter in the define custom views feature. NOTE: vector 2 is only exploitable by users with administer views permissions.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 59% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VI
Views · Drupal
6.x-2.0; 6.x-2.1; 6.x-2.2; 6.x-2.3; 6.x-2.4; 6.x-2.5 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-2076
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-2076
Patch
http://drupal.org/node/488068
Patch
http://drupal.org/node/488082
Exploit
http://lampsecurity.org/drupal-views-xss-vulnerability
Vendor Advisory
http://secunia.com/advisories/35425
www.securityfocus.com
http://www.securityfocus.com/bid/35304
More from Views
–
CVE-2008-6020
SQL injection vulnerability in the Views module 6.x before 6.x-2.2 for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors related to "an…