Description

Cross-site scripting (XSS) vulnerability in the Menu module (modules/menu/menu.admin.inc) in Drupal Core 6.x before 6.15 allows remote authenticated users with permissions to create new menus to inject arbitrary web script or HTML via a menu description, which is not properly handled in the menu administration overview.

Remediation

References

CVE-2009-4370

Related Vulnerabilities

Liferay DXP Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-33328)

OpenSSL Out-of-bounds Read Vulnerability (CVE-2016-6306)

WordPress Plugin Popup, Optin Form & Email Newsletters for Mailchimp, HubSpot, Aweber-MailOptin Security Bypass (1.2.35.1)

Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-25631)

WordPress 4.5.x Multiple Vulnerabilities (4.5 - 4.5.24)

Severity

Low

Classification

CVE-2009-4370 CWE-707

Tags

Missing Update Known Vulnerabilities