Cross site scripting

2009-09-1018:30:00

PRIOn knowledge base

www.prio-n.com

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

41.7%

JSON

Cross-site scripting (XSS) vulnerability in the Calendar module 6.x before 6.x-2.2 for Drupal allows remote authenticated users, with “create new content types” privileges, to inject arbitrary web script or HTML via the title of a content type.

CPENameOperatorVersion
calendareq6.x-2.0 beta
calendareq6.x-2.0 rc1
calendareq6.x-2.0 rc6
calendareq6.x-2.0 rc5
calendareq6.x-2.0 beta3
calendareq6.120.20
calendareq6.x-2.0 rc4
calendareq6.x-2.0 rc2
calendareq6.x-2.0 beta2
calendareq6.x-2.0 beta4

Name	Operator	Version
calendar	eq	6.x-2.0 beta
calendar	eq	6.x-2.0 rc1
calendar	eq	6.x-2.0 rc6
calendar	eq	6.x-2.0 rc5
calendar	eq	6.x-2.0 beta3
calendar	eq	6.120.20
calendar	eq	6.x-2.0 rc4
calendar	eq	6.x-2.0 rc2
calendar	eq	6.x-2.0 beta2
calendar	eq	6.x-2.0 beta4

Rows per page:

1-10 of 131

References

lampsecurity.org/drupal-date-xss-vulnerability

secunia.com/advisories/36012

www.osvdb.org/56611

www.securityfocus.com/bid/35790

drupal.org/node/534336

drupal.org/node/534652