Lucene search

[email protected]CVE-2009-4513

HistoryDec 31, 2009 - 7:30 p.m.

CVE-2009-4513

2009-12-3119:30:00

CWE-79

[email protected]

web.nvd.nist.gov

drupal

workflow module

xss

cve-2009-4513

nvd

security vulnerability

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

5.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.5%

JSON

Multiple cross-site scripting (XSS) vulnerabilities in the Workflow module 5.x before 5.x-2.4 and 6.x before 6.x-1.2, a module for Drupal, allow remote authenticated users, with “administer workflow” privileges, to inject arbitrary web script or HTML via the name of a (1) workflow or (2) workflow state.

Affected configurations

NVD

Node

john_vandykworkflowRange≤5.x-2.3

john_vandykworkflowMatch5.x-1.0

john_vandykworkflowMatch5.x-1.0-beta1

john_vandykworkflowMatch5.x-1.1

john_vandykworkflowMatch5.x-1.2

john_vandykworkflowMatch5.x-2.0

john_vandykworkflowMatch5.x-2.1

john_vandykworkflowMatch5.x-2.2

john_vandykworkflowMatch5.x-2.x-dev

john_vandykworkflowMatch6.x-1.0

john_vandykworkflowMatch6.x-1.0-beta1

john_vandykworkflowMatch6.x-1.0-beta2

john_vandykworkflowMatch6.x-1.0-rc1

john_vandykworkflowMatch6.x-1.0-rc3

john_vandykworkflowMatch6.x-1.0-rc4

john_vandykworkflowMatch6.x-1.1

john_vandykworkflowMatch6.x-1.x-dev

AND

drupaldrupal

CPENameOperatorVersion
john_vandyk:workflowjohn vandyk workflowle5.x-2.3
john_vandyk:workflowjohn vandyk workfloweq5.x-1.0
john_vandyk:workflowjohn vandyk workfloweq5.x-1.0-beta1
john_vandyk:workflowjohn vandyk workfloweq5.x-1.1
john_vandyk:workflowjohn vandyk workfloweq5.x-1.2
john_vandyk:workflowjohn vandyk workfloweq5.x-2.0
john_vandyk:workflowjohn vandyk workfloweq5.x-2.1
john_vandyk:workflowjohn vandyk workfloweq5.x-2.2
john_vandyk:workflowjohn vandyk workfloweq5.x-2.x-dev
john_vandyk:workflowjohn vandyk workfloweq6.x-1.0

CPE	Name	Operator	Version
john_vandyk:workflow	john vandyk workflow	le	5.x-2.3
john_vandyk:workflow	john vandyk workflow	eq	5.x-1.0
john_vandyk:workflow	john vandyk workflow	eq	5.x-1.0-beta1
john_vandyk:workflow	john vandyk workflow	eq	5.x-1.1
john_vandyk:workflow	john vandyk workflow	eq	5.x-1.2
john_vandyk:workflow	john vandyk workflow	eq	5.x-2.0
john_vandyk:workflow	john vandyk workflow	eq	5.x-2.1
john_vandyk:workflow	john vandyk workflow	eq	5.x-2.2
john_vandyk:workflow	john vandyk workflow	eq	5.x-2.x-dev
john_vandyk:workflow	john vandyk workflow	eq	6.x-1.0

Rows per page:

1-10 of 171

References

drupal.org/node/612832

drupal.org/node/612834

drupal.org/node/617456

secunia.com/advisories/37203

www.securityfocus.com/bid/36878

www.vupen.com/english/advisories/2009/3089

exchange.xforce.ibmcloud.com/vulnerabilities/54028

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

5.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

45.5%

JSON

Related for CVE-2009-4513

prion1 cvelist1 nvd1