CVE-2009-2371

EUVD-2009-2367
Advanced Forum 6.x before 6.x-1.1, a module for Drupal, does not prevent users from modifying user signatures after the associated comment format has been changed to an administrator-controlled input format, which allows remote authenticated users to inject arbitrary web script, HTML, and possibly PHP code via a crafted user signature.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.5 UNKNOWN
NETWORK
LOW
AV:N/AC:L/Au:S/C:P/I:P/A:P
Base Score
CVSS 3.x
EPSS Score
Percentile: 70%
Affected Products (NVD)
VendorProductVersion
michelle_coxadvanced_forum
6.x-1.0:x
michelle_coxadvanced_forum
6.x-1.x-dev:x
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://drupal.org/node/507526
http://drupal.org/node/507580
http://osvdb.org/55522
http://secunia.com/advisories/35678
http://www.vupen.com/english/advisories/2009/1769
http://drupal.org/node/507526
http://drupal.org/node/507580
http://osvdb.org/55522
http://secunia.com/advisories/35678
http://www.vupen.com/english/advisories/2009/1769