CVE-2009-4370 | Vulnetix

CVE-2009-4370 PUBLISHED

Reported by mitre · Published December 21, 2009

Cross-site scripting (XSS) vulnerability in the Menu module (modules/menu/menu.admin.inc) in Drupal Core 6.x before 6.15 allows remote authenticated users with permissions to create new menus to inject arbitrary web script or HTML via a menu description, which is not properly handled in the menu administration overview.

Affected products

Vendor	Product	Versions
n/a	n/a	n/a
drupal	drupal
n/a	n/a	*

Timeline

Dec 21, 2009 CVE Published
Feb 4, 2022 EPSS Score (30 in total, the first dated here)
Apr 8, 2026 Security Advisory
Apr 23, 2026 CVE Updated
Nov 3, 2026 Coalition ESS Score

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2009-4370
vulnetix vdb fixes CVE-2009-4370

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2009-4370/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

x_refsource_CONFIRM
x_refsource_CONFIRM
37372 vdb-entryx_refsource_BID
drupal-menu-xss(54872) vdb-entryx_refsource_XF
37815 third-party-advisoryx_refsource_SECUNIA

Look up in the Resolve Platform →