製品・ソフトウェアに関する情報

JVN脆弱性詳細

Drupal 用の Automated Logout モジュールにおけるクロスサイトスクリプティングの脆弱性

Title	Drupal 用の Automated Logout モジュールにおけるクロスサイトスクリプティングの脆弱性
Summary	Drupal 用の Automated Logout モジュールには、クロスサイトスクリプティングの脆弱性が存在します。
Possible impacts	自動ログアウトの管理者権限を持つリモート認証されたユーザにより、任意の Web スクリプトまたは HTML を挿入される可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Dec. 23, 2009, midnight
Registration Date	Sept. 25, 2012, 5:38 p.m.
Last Update	Sept. 25, 2012, 5:38 p.m.

Affected System

james glasgow

autologout 6.x-1.7 未満の 6.x-1.x、および 6.x-2.3 未満の 6.x-2.x

john vandervort

autologout 6.x-1.7 未満の 6.x-1.x、および 6.x-2.3 未満の 6.x-2.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2009-4829	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4829
National Vulnerability Database (NVD)
2	CVE-2009-4829	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2009-4829

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-79	https://jvndb.jvn.jp/ja/cwe/CWE-79.html

ベンダー情報

No	Name	URL
james glasgow
1	SA-CONTRIB-2009-114	http://drupal.org/node/667094
john vandervort
2	Automated Logout	http://www.downloadplex.com/Scripts/PHP/Modules/Publisher-automated-logout-scripts_249622.html

Change Log

No	Changed Details	Date of change
0	[2012年09月25日] 掲載	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2009-4829

Summary	Cross-site scripting (XSS) vulnerability in the Automated Logout module 6.x-1.x before 6.x-1.7 and 6.x-2.x before 6.x-2.3 for Drupal allows remote authenticated users with administer autologout privileges to inject arbitrary web script or HTML via unspecified vectors.
Publication Date	April 28, 2010, 12:30 a.m.
Registration Date	Jan. 29, 2021, 1:28 p.m.
Last Update	April 28, 2010, 1 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:james_glasgow:autologout:6.x-1.0:beta::::::
cpe:2.3:a:james_glasgow:autologout:6.x-1.1:::::::*
cpe:2.3:a:james_glasgow:autologout:6.x-1.4:::::::*
cpe:2.3:a:james_glasgow:autologout:6.x-1.6:::::::*
cpe:2.3:a:james_glasgow:autologout:6.x-1.x:dev::::::
cpe:2.3:a:james_glasgow:autologout:6.x-2.0:::::::*
cpe:2.3:a:james_glasgow:autologout:6.x-2.1:::::::*
cpe:2.3:a:john_vandervort:autologout:6.x-1.1:beta::::::
cpe:2.3:a:john_vandervort:autologout:6.x-1.2:::::::*
cpe:2.3:a:john_vandervort:autologout:6.x-1.3:::::::*
cpe:2.3:a:john_vandervort:autologout:6.x-1.5:::::::*
cpe:2.3:a:john_vandervort:autologout:6.x-2.2:::::::*
cpe:2.3:a:john_vandervort:autologout:6.x-2.x:dev::::::
execution environment
1	cpe:2.3:a:drupal:drupal::::::::

Related information, measures and tools

No	URL	refsource	タグ
1	http://drupal.org/node/667084	CONFIRM	Patch
2	http://drupal.org/node/667086	CONFIRM	Patch
3	http://drupal.org/node/667094	CONFIRM	Patch Vendor Advisory
4	http://osvdb.org/61295	OSVDB
5	http://secunia.com/advisories/37878	SECUNIA	Vendor Advisory
6	http://www.securityfocus.com/bid/37462	BID	Patch
7	http://www.vupen.com/english/advisories/2009/3633	VUPEN	Vendor Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-79	クロスサイト・スクリプティング（XSS）	https://cwe.mitre.org/data/definitions/79.html

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:james_glasgow:autologout:6.x-1.0:beta::::::
cpe:2.3:a:james_glasgow:autologout:6.x-1.1:::::::*
cpe:2.3:a:james_glasgow:autologout:6.x-1.4:::::::*
cpe:2.3:a:james_glasgow:autologout:6.x-1.6:::::::*
cpe:2.3:a:james_glasgow:autologout:6.x-1.x:dev::::::
cpe:2.3:a:james_glasgow:autologout:6.x-2.0:::::::*
cpe:2.3:a:james_glasgow:autologout:6.x-2.1:::::::*
cpe:2.3:a:john_vandervort:autologout:6.x-1.1:beta::::::
cpe:2.3:a:john_vandervort:autologout:6.x-1.2:::::::*
cpe:2.3:a:john_vandervort:autologout:6.x-1.3:::::::*
cpe:2.3:a:john_vandervort:autologout:6.x-1.5:::::::*
cpe:2.3:a:john_vandervort:autologout:6.x-2.2:::::::*
cpe:2.3:a:john_vandervort:autologout:6.x-2.x:dev::::::
execution environment
1	cpe:2.3:a:drupal:drupal::::::::