CVE-2009-2372

Drupal 6.x before 6.13 does not prevent users from modifying user signatures after the associated comment format has been changed to an…

published July 8, 2009

CVSS
—
EPSS
2%
Percentile
83.2
In the wild
Unconfirmed
What it is

Drupal 6.x before 6.13 does not prevent users from modifying user signatures after the associated comment format has been changed to an administrator-controlled input format, which allows remote authenticated users to inject arbitrary web script, HTML, and possibly PHP code via a crafted user signature.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02308 · 83.2th percentile
Published
2009-07-08T15:00Z
EPSS history
Timeline
  • 08 JUL 15:00Z
    Drupal 6.x before 6.13 does not prevent users from modifying user signatures after the associated comment format has been changed to an…
    cvelistv5