CVE-2009-1575
Summary
| CVE | CVE-2009-1575 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2009-05-06 17:30:09 UTC |
| Updated | 2026-04-23 00:35:47 UTC |
| Description | Cross-site scripting (XSS) vulnerability in Drupal 5.x before 5.17 and 6.x before 6.11, as used in vbDrupal before 5.17.0, allows remote attackers to inject arbitrary web script or HTML via crafted UTF-8 byte sequences before the Content-Type meta tag, which are treated as UTF-7 by Internet Explorer 6 and 7. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
NoneConfidentiality
NoneIntegrity
PartialAvailability
NoneAV:N/AC:M/Au:N/C:N/I:P/A:N
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Drupal | Drupal | 5.0 | All | All | All |
| Application | Drupal | Drupal | 5.0 | beta1 | All | All |
| Application | Drupal | Drupal | 5.0 | beta2 | All | All |
| Application | Drupal | Drupal | 5.0 | rc1 | All | All |
| Application | Drupal | Drupal | 5.0 | rc2 | All | All |
| Application | Drupal | Drupal | 5.1 | All | All | All |
| Application | Drupal | Drupal | 5.10 | All | All | All |
| Application | Drupal | Drupal | 5.11 | All | All | All |
| Application | Drupal | Drupal | 5.12 | All | All | All |
| Application | Drupal | Drupal | 5.13 | All | All | All |
| Application | Drupal | Drupal | 5.14 | All | All | All |
| Application | Drupal | Drupal | 5.15 | All | All | All |
| Application | Drupal | Drupal | 5.16 | All | All | All |
| Application | Drupal | Drupal | 5.1_rev1.1 | All | All | All |
| Application | Drupal | Drupal | 5.2 | All | All | All |
| Application | Drupal | Drupal | 5.3 | All | All | All |
| Application | Drupal | Drupal | 5.4 | All | All | All |
| Application | Drupal | Drupal | 5.5 | All | All | All |
| Application | Drupal | Drupal | 5.5. | All | All | All |
| Application | Drupal | Drupal | 5.6 | All | All | All |
| Application | Drupal | Drupal | 5.7 | All | All | All |
| Application | Drupal | Drupal | 5.8 | All | All | All |
| Application | Drupal | Drupal | 5.9 | All | All | All |
| Application | Drupal | Drupal | 6 | All | All | All |
| Application | Drupal | Drupal | 6 | beta1 | All | All |
| Application | Drupal | Drupal | 6.0 | All | All | All |
| Application | Drupal | Drupal | 6.0 | beta1 | All | All |
| Application | Drupal | Drupal | 6.0 | beta2 | All | All |
| Application | Drupal | Drupal | 6.0 | beta3 | All | All |
| Application | Drupal | Drupal | 6.0 | beta4 | All | All |
| Application | Drupal | Drupal | 6.0 | rc-1 | All | All |
| Application | Drupal | Drupal | 6.0 | rc-2 | All | All |
| Application | Drupal | Drupal | 6.0 | rc-3 | All | All |
| Application | Drupal | Drupal | 6.0 | rc-4 | All | All |
| Application | Drupal | Drupal | 6.1 | All | All | All |
| Application | Drupal | Drupal | 6.10 | All | All | All |
| Application | Drupal | Drupal | 6.2 | All | All | All |
| Application | Drupal | Drupal | 6.3 | All | All | All |
| Application | Drupal | Drupal | 6.4 | All | All | All |
| Application | Drupal | Drupal | 6.5 | All | All | All |
| Application | Drupal | Drupal | 6.6 | All | All | All |
| Application | Drupal | Drupal | 6.7 | All | All | All |
| Application | Drupal | Drupal | 6.8 | All | All | All |
| Application | Drupal | Drupal | 6.9 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Debian -- Security Information -- DSA-1792-1 drupal6 | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | Patch, Vendor Advisory |
| vbDrupal 5.17.0 released - vbDrupal Forums | af854a3a-2127-422b-91ae-364da2661108 | www.vbdrupal.org | Patch, Vendor Advisory |
| Drupal Script Insertion and Information Disclosure - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| [SECURITY] Fedora 10 Update: drupal-6.11-1.fc10 | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| Debian update for drupal6 - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| SA-CORE-2009-005 - Drupal core - Cross site scripting | drupal.org | af854a3a-2127-422b-91ae-364da2661108 | drupal.org | Patch, Vendor Advisory |
| vbDrupal Script Insertion and Information Disclosure - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| www.osvdb.org/54152 | af854a3a-2127-422b-91ae-364da2661108 | www.osvdb.org | Patch |
| [SECURITY] Fedora 9 Update: drupal-6.11-1.fc9 | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.