CVE-2009-3157
Quick assessment
Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Drupal日历模块6.x-2.3版本之前的6.x版本中存在跨站脚本攻击漏洞。具有"创建新内容种类"特权的远程认证用户可以借助一个内容种类的标题，注入任意网络脚本或HTML。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2009-3157
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Cross-site scripting (XSS) vulnerability in the Calendar module 6.x before 6.x-2.2 for Drupal allows remote authenticated users, with "create new content types" privileges, to inject arbitrary web script or HTML via the title of a content type.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Drupal Date模块Wizard HTML注入漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Drupal日历模块6.x-2.3版本之前的6.x版本中存在跨站脚本攻击漏洞。具有"创建新内容种类"特权的远程认证用户可以借助一个内容种类的标题，注入任意网络脚本或HTML。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2009-3157
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2009-3157
请登录查看更多情报信息。
Vendor Advisories for CVE-2009-3157 (3)
Other References for CVE-2009-3157 (3)
-
http://drupal.org/node/534336 x_refsource_CONFIRM
-
http://drupal.org/node/534652 x_refsource_CONFIRM
-
http://lampsecurity.org/drupal-date-xss-vulnerability x_refsource_MISC
Same Patch Batch · n/a · 2009-09-10 · 55 CVEs total
| CVE-2009-3156 | Drupal Date模块Wizard HTML注入漏洞 | |
| CVE-2008-7201 | Lantronix MSS485-T 拒绝服务攻击漏洞 | |
| CVE-2008-7196 | metashell未明漏洞 | |
| CVE-2008-7199 | phoenixcontact fl_il_24_bk-pac 拒绝服务攻击漏洞 | |
| CVE-2008-7198 | Alecwh phpns未明漏洞 | |
| CVE-2008-7197 | G15Tools g15daemon多个未明漏洞 | |
| CVE-2008-7200 | Deliantra服务器引擎 双重释放拒绝服务漏洞 | |
| CVE-2009-3160 | IBM WebSphere MQ 未明漏洞 | |
| CVE-2009-3159 | IBM WebSphere MQ rriDecompress函数未明漏洞 | |
| CVE-2009-3158 | carsten_wulff simplephpweb 授权问题漏洞 | |
| CVE-2009-3161 | IBM WebSphere MQ 未明拒绝服务漏洞 | |
| CVE-2009-3155 | almondsoft com_aclassf 跨站脚本攻击漏洞 | |
| CVE-2009-3154 | almondsoft com_aclassf SQL注入漏洞 | |
| CVE-2009-3153 | x10media mp3_search_engine 跨站脚本攻击漏洞 | |
| CVE-2009-3152 | NTSOFT BBS E-Market Professional 多个跨站脚本攻击漏洞 | |
| CVE-2009-3151 | ultrize timesheet 路径游历漏洞 | |
| CVE-2009-3150 | Multi Website SQL注入漏洞 | |
| CVE-2009-3149 | Curveriderhq elgg路径遍历漏洞 | |
| CVE-2009-3148 | portalxp SQL注入漏洞 | |
| CVE-2009-3147 | ReviewPost Pro 'showproduct.php'跨站脚本攻击漏洞 |
Showing top 20 of 55 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2009-3157
No comments yet