Cross-Site Scripting Vulnerability in Drupal Content Construction Kit Module

CVE-2009-1069

Summary

The Drupal Content Construction Kit (CCK) module has multiple vulnerabilities that enable remote attackers to execute arbitrary web scripts or HTML. These vulnerabilities stem from the node edit form, particularly within the Node reference sub-module and the User reference sub-module. Attackers can manipulate the titles of candidate referenced nodes and the names of candidate referenced users, potentially compromising site integrity and exposing sensitive user data. It's crucial to apply relevant updates and patches to mitigate these risks and ensure Drupal installations remain secure.

References