CVE-2009-2076

Severity: low (CVSS 3.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2009-06-16 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in Views 6.x before 6.x-2.6, a module for Drupal, allows remote authenticated users to inject arbitrary web script or HTML via (1) exposed filters in the Views UI administrative interface and in the (2) view name parameter in the define custom views feature. NOTE: vector 2 is only exploitable by users with administer views permissions.

Affected products

Drupal Views: 6.x-2.0, 6.x-2.1, 6.x-2.2, 6.x-2.3, 6.x-2.4, 6.x-2.5

References

http://drupal.org/node/488068
http://drupal.org/node/488082
http://lampsecurity.org/drupal-views-xss-vulnerability
http://secunia.com/advisories/35425
http://www.securityfocus.com/bid/35304
http://drupal.org/node/488068
http://drupal.org/node/488082
http://lampsecurity.org/drupal-views-xss-vulnerability
http://secunia.com/advisories/35425
http://www.securityfocus.com/bid/35304

Get alerted when CVE-2009-2076 or the next vulnerability affects your stack