CVE-2009-2076

Description

Cross-site scripting (XSS) vulnerability in Views 6.x before 6.x-2.6, a module for Drupal, allows remote authenticated users to inject arbitrary web script or HTML via (1) exposed filters in the Views UI administrative interface and in the (2) view name parameter in the define custom views feature. NOTE: vector 2 is only exploitable by users with administer views permissions.

References

http://www.securityfocus.com/bid/35304

http://secunia.com/advisories/35425

http://drupal.org/node/488082

http://drupal.org/node/488068

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3

EPSS