CVE Daily

CVE-2009-4371

Cross-site scripting (XSS) vulnerability in the Locale module (modules/locale/lo...

Low CVSS 3.5

Overview

Cross-site scripting (XSS) vulnerability in the Locale module (modules/locale/locale.module) in Drupal Core 6.14, and possibly other versions including 6.15, allows remote authenticated users with "administer languages" permissions to inject arbitrary web script or HTML via the (1) Language name in English or (2) Native language name fields in the Custom language form.

CWE: CWE-79 Published: 2009-12-21T16:30:00.687
Risk analysis

This vulnerability is rated 🟢 LOW.

  • CVSS: 3.5 (LOW)
  • Detected tags: none (tag impact: LOW)

Recommended actions:

  • Prioritize remediation based on business criticality and exposure.
  • Limit exposure and increase monitoring until fixed.

Recommended tools

Tags