CVE-2009-2372

Severity: medium (CVSS 6.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2009-07-08 · updated 2026-06-16
Weakness: CWE-94

Description

Drupal 6.x before 6.13 does not prevent users from modifying user signatures after the associated comment format has been changed to an administrator-controlled input format, which allows remote authenticated users to inject arbitrary web script, HTML, and possibly PHP code via a crafted user signature.

Affected products

Drupal: from 6.0 before 6.13 — fixed in 6.13

How to fix

Upgrade to a fixed version: Drupal 6.13. Check the vendor advisory for mitigations.

References

http://drupal.org/node/507572
http://osvdb.org/55525
http://secunia.com/advisories/35681
http://www.securitytracker.com/id?1022497
http://drupal.org/node/507572
http://osvdb.org/55525
http://secunia.com/advisories/35681
http://www.securitytracker.com/id?1022497

Get alerted when CVE-2009-2372 or the next vulnerability affects your stack