Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2010-2472

Locale module and dependent contributed modules in Drupal 6.x before 6.16 and 5.x before version 5.22 do not sanitize the display of language codes, native and English language names properly which could allow an attacker to perform a cross-site scripting (XSS) attack. This vulnerability is mitigated by the fact that an attacker must have a role with the 'administer languages' permission.

Published

2019-11-07T19:15:12.893

Last Modified

2024-11-21T01:16:44.120

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 4.8 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Access Vector: NETWORK
Access Complexity: MEDIUM
Authentication: SINGLE
Confidentiality Impact: NONE
Integrity Impact: PARTIAL
Availability Impact: NONE

Exploitability Score

6.8

Impact Score

2.9

Weaknesses

Type: Primary
CWE-79

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	drupal	drupal	< 5.22	Yes
Application	drupal	drupal	< 6.16	Yes

References

https://security-tracker.debian.org/tracker/CVE-2010-2472 Third Party Advisory ([email protected])
https://www.drupal.org/node/731710 Patch, Vendor Advisory ([email protected])
https://www.openwall.com/lists/oss-security/2010/06/28/8 Mailing List, Third Party Advisory ([email protected])
https://security-tracker.debian.org/tracker/CVE-2010-2472 Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.drupal.org/node/731710 Patch, Vendor Advisory (af854a3a-2127-422b-91ae-364da2661108)
https://www.openwall.com/lists/oss-security/2010/06/28/8 Mailing List, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)