Description

Cross-site scripting (XSS) vulnerability in the Date Tools sub-module in the Date module 6.x before 6.x-2.3 for Drupal allows remote authenticated users, with "use date tools" or "administer content types" privileges, to inject arbitrary web script or HTML via a "Content type label" field.

Remediation

References

CVE-2009-3156

Related Vulnerabilities

Apache Traffic Server Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') Vulnerability (CVE-2021-43082)

Jboss EAP Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2017-7465)

Apache HTTP Server Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2007-4465)

Piwigo Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2014-3900)

Magento Improper Authorization Vulnerability (CVE-2021-21022)

Severity

Low

Classification

CVE-2009-3156 CWE-707

Tags

Missing Update Known Vulnerabilities