Vulnerability Description
Cross-site scripting (XSS) vulnerability in the Webform module 5.x before 5.x-2.8 and 6.x before 6.x-2.8, a module for Drupal, allows remote authenticated users, with webform creation privileges, to inject arbitrary web script or HTML via a field label.
CVSS Score
LOW
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Nathan Haug | Webform | <= 5.x-2.7 |
| Drupal | Drupal | All versions |
Related Weaknesses (CWE)
References
- http://drupal.org/node/604942PatchVendor Advisory
- http://osvdb.org/58945
- http://secunia.com/advisories/37021Vendor Advisory
- http://www.securityfocus.com/bid/36708Patch
- http://www.vupen.com/english/advisories/2009/2923PatchVendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53796
- http://drupal.org/node/604942PatchVendor Advisory
- http://osvdb.org/58945
- http://secunia.com/advisories/37021Vendor Advisory
- http://www.securityfocus.com/bid/36708Patch
- http://www.vupen.com/english/advisories/2009/2923PatchVendor Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/53796
FAQ
What is CVE-2009-4532?
CVE-2009-4532 is a vulnerability with a CVSS score of 3.5 (LOW). Cross-site scripting (XSS) vulnerability in the Webform module 5.x before 5.x-2.8 and 6.x before 6.x-2.8, a module for Drupal, allows remote authenticated users, with webform creation privileges, to i...
How severe is CVE-2009-4532?
CVE-2009-4532 has been rated LOW with a CVSS base score of 3.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2009-4532?
Check the references section above for vendor advisories and patch information. Affected products include: Nathan Haug Webform, Drupal Drupal.