CVE-2009-2372: Drupal

Medium severity, CVSS 6.5. EPSS: 2.3% chance of exploitation in the next 30 days.

Drupal 6.x before 6.13 does not prevent users from modifying user signatures after the associated comment format has been changed to an administrator-controlled input format, which allows remote authenticated users to inject arbitrary web script, HTML, and possibly PHP code via a crafted user signature.

Affected products

• Drupal Drupal: from 6.0, before 6.13 (fixed in 6.13)

Published 2009-07-08. Last modified 2026-06-16.