CVE-2009-3156
10.09.2009, 18:30
Cross-site scripting (XSS) vulnerability in the Date Tools sub-module in the Date module 6.x before 6.x-2.3 for Drupal allows remote authenticated users, with "use date tools" or "administer content types" privileges, to inject arbitrary web script or HTML via a "Content type label" field.
| Vendor | Product | Version |
|---|---|---|
| drupal | drupal | * |
| karen_stevenson | date | 6.x-1.0-beta:x |
| karen_stevenson | date | 6.x-1.x-dev:x |
| karen_stevenson | date | 6.x-2.0:x |
| karen_stevenson | date | 6.x-2.0:x |
| karen_stevenson | date | 6.x-2.0:x |
| karen_stevenson | date | 6.x-2.0:x |
| karen_stevenson | date | 6.x-2.0:x |
| karen_stevenson | date | 6.x-2.0:x |
| karen_stevenson | date | 6.x-2.0:x |
| karen_stevenson | date | 6.x-2.0-beta:x |
| karen_stevenson | date | 6.x-2.0-beta2:x |
| karen_stevenson | date | 6.x-2.0-beta3:x |
| karen_stevenson | date | 6.x-2.0-beta4:x |
| karen_stevenson | date | 6.x-2.1:x |
| karen_stevenson | date | 6.x-2.2:x |
𝑥
= Vulnerable software versions
References