Description

Cross-site scripting (XSS) vulnerability in the Menu module (modules/menu/menu.admin.inc) in Drupal Core 6.x before 6.15 allows remote authenticated users with permissions to create new menus to inject arbitrary web script or HTML via a menu description, which is not properly handled in the menu administration overview.

Remediation

References

CVE-2009-4370

Related Vulnerabilities

WordPress Plugin Add Link to Facebook Cross-Site Scripting (2.2.7)

WordPress 3.7.x Multiple Vulnerabilities (3.7 - 3.7.16)

TYPO3 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2011-4626)

Jenkins Incorrect Authorization Vulnerability (CVE-2020-2104)

Oracle Application Server CVE-2008-7237 Vulnerability (CVE-2008-7237)

Severity

Low

Classification

CVE-2009-4370 CWE-707

Tags

Missing Update Known Vulnerabilities