Description

Cross-site scripting (XSS) vulnerability in the Menu module (modules/menu/menu.admin.inc) in Drupal Core 6.x before 6.15 allows remote authenticated users with permissions to create new menus to inject arbitrary web script or HTML via a menu description, which is not properly handled in the menu administration overview.

Remediation

References

CVE-2009-4370

Related Vulnerabilities

Oracle JRE CVE-2019-2981 Vulnerability (CVE-2019-2981)

WordPress Plugin Image Hover Effects-Elementor Addon Multiple Cross-Site Scripting Vulnerabilities (1.3.3)

WordPress Plugin AliExpress Dropshipping with AliNext Lite Cross-Site Request Forgery (3.3.5)

b2evolution Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2007-0175)

Joomla Incorrect Permission Assignment for Critical Resource Vulnerability (CVE-2011-4912)

Severity

Low

Classification

CVE-2009-4370 CWE-707

Tags

Missing Update Known Vulnerabilities