CVE-2009-3435 : Cross-site scripting (XSS) vulnerability in the variable editor in the Devel mod

Cross-site scripting (XSS) vulnerability in the variable editor in the Devel module 5.x before 5.x-1.2 and 6.x before 6.x-1.18, a module for Drupal, allows remote attackers to inject arbitrary web script or HTML via a variable name.

Published 2009-09-28 22:30:01

Updated 2017-08-17 01:31:07

Source MITRE

View at NVD, CVE.org

Vulnerability category: Cross site scripting (XSS)

Products affected by CVE-2009-3435

Moshe Weitzman » Devel » Version: 5.x-1.x-dev
cpe:2.3:a:moshe_weitzman:devel:5.x-1.x-dev:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal
Moshe Weitzman » Devel » Version: 6.x-1.0
cpe:2.3:a:moshe_weitzman:devel:6.x-1.0:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal
Moshe Weitzman » Devel » Version: 6.x-1.1
cpe:2.3:a:moshe_weitzman:devel:6.x-1.1:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal
Moshe Weitzman » Devel » Version: 6.x-1.2
cpe:2.3:a:moshe_weitzman:devel:6.x-1.2:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal
Moshe Weitzman » Devel » Version: 6.x-1.9
cpe:2.3:a:moshe_weitzman:devel:6.x-1.9:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal
Moshe Weitzman » Devel » Version: 6.x-1.10
cpe:2.3:a:moshe_weitzman:devel:6.x-1.10:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal
Moshe Weitzman » Devel » Version: 6.x-1.17
cpe:2.3:a:moshe_weitzman:devel:6.x-1.17:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal
Moshe Weitzman » Devel » Version: 6.x-1.x-dev
cpe:2.3:a:moshe_weitzman:devel:6.x-1.x-dev:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal
Moshe Weitzman » Devel » Version: 5.x-0.3
cpe:2.3:a:moshe_weitzman:devel:5.x-0.3:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal
Moshe Weitzman » Devel » Version: 5.x-0.4
cpe:2.3:a:moshe_weitzman:devel:5.x-0.4:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal
Moshe Weitzman » Devel » Version: 6.x-1.5
cpe:2.3:a:moshe_weitzman:devel:6.x-1.5:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal
Moshe Weitzman » Devel » Version: 6.x-1.6
cpe:2.3:a:moshe_weitzman:devel:6.x-1.6:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal
Moshe Weitzman » Devel » Version: 6.x-1.13
cpe:2.3:a:moshe_weitzman:devel:6.x-1.13:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal
Moshe Weitzman » Devel » Version: 6.x-1.14
cpe:2.3:a:moshe_weitzman:devel:6.x-1.14:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal
Moshe Weitzman » Devel » Version: 5.x-1.0
cpe:2.3:a:moshe_weitzman:devel:5.x-1.0:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal
Moshe Weitzman » Devel » Version: 5.x-1.1
cpe:2.3:a:moshe_weitzman:devel:5.x-1.1:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal
Moshe Weitzman » Devel » Version: 6.x-1.7
cpe:2.3:a:moshe_weitzman:devel:6.x-1.7:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal
Moshe Weitzman » Devel » Version: 6.x-1.8
cpe:2.3:a:moshe_weitzman:devel:6.x-1.8:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal
Moshe Weitzman » Devel » Version: 6.x-1.15
cpe:2.3:a:moshe_weitzman:devel:6.x-1.15:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal
Moshe Weitzman » Devel » Version: 6.x-1.16
cpe:2.3:a:moshe_weitzman:devel:6.x-1.16:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal
Moshe Weitzman » Devel » Version: 5.x-0.1
cpe:2.3:a:moshe_weitzman:devel:5.x-0.1:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal
Moshe Weitzman » Devel » Version: 5.x-0.2
cpe:2.3:a:moshe_weitzman:devel:5.x-0.2:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal
Moshe Weitzman » Devel » Version: 6.x-1.3
cpe:2.3:a:moshe_weitzman:devel:6.x-1.3:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal
Moshe Weitzman » Devel » Version: 6.x-1.4
cpe:2.3:a:moshe_weitzman:devel:6.x-1.4:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal
Moshe Weitzman » Devel » Version: 6.x-1.11
cpe:2.3:a:moshe_weitzman:devel:6.x-1.11:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal
Moshe Weitzman » Devel » Version: 6.x-1.12
cpe:2.3:a:moshe_weitzman:devel:6.x-1.12:*:*:*:*:*:*:*
Matching versions
When used together with: Drupal » Drupal

Exploit prediction scoring system (EPSS) score for CVE-2009-3435

EPSS FAQ

0.25%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 62 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2009-3435

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None

CWE ids for CVE-2009-3435

CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2009-3435

https://exchange.xforce.ibmcloud.com/vulnerabilities/53449
http://drupal.org/node/585952

Patch;Vendor Advisory
http://www.securityfocus.com/bid/36508

Patch

Jump to

Vulnerability Details : CVE-2009-3435

Products affected by CVE-2009-3435

Exploit prediction scoring system (EPSS) score for CVE-2009-3435

CVSS scores for CVE-2009-3435

CWE ids for CVE-2009-3435

References for CVE-2009-3435