Description

Cross-site scripting (XSS) vulnerability in the Date Tools sub-module in the Date module 6.x before 6.x-2.3 for Drupal allows remote authenticated users, with "use date tools" or "administer content types" privileges, to inject arbitrary web script or HTML via a "Content type label" field.

Remediation

References

CVE-2009-3156

Related Vulnerabilities

Liferay DXP Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2022-42123)

Craft CMS CVE-2024-21622 Vulnerability (CVE-2024-21622)

Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-3546)

Oracle Database Server CVE-2015-4796 Vulnerability (CVE-2015-4796)

Dotclear Improper Access Control Vulnerability (CVE-2015-8832)

Severity

Low

Classification

CVE-2009-3156 CWE-707

Tags

Missing Update Known Vulnerabilities