PT-2010-2448 · Drupal · Itween Upload Module

Publicado 2010-02-23 · Atualizado 2017-08-17 · CVE-2010-0697

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions iTween Upload module versions 6.x-1.x before 6.x-1.2 iTween Upload module versions 6.x-2.x before 6.x-2.3

Description A cross-site scripting (XSS) issue exists in the iTweak Upload module for Drupal, allowing remote authenticated users with create content and upload file permissions to inject arbitrary web script or HTML via the file name of an uploaded file.

Recommendations For iTweak Upload module versions 6.x-1.x before 6.x-1.2, update to version 6.x-1.2 or later. For iTweak Upload module versions 6.x-2.x before 6.x-2.3, update to version 6.x-2.3 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2010-0697

Produtos afetados

Itween Upload Module

Referências · 8

• http://secunia.com/advisories/38633 · Aviso do Fabricante
• http://drupal.org/node/711074 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2010-0697 · Nota de Segurança
• http://securityfocus.com/bid/38292 · Correção
• https://exchange.xforce.ibmcloud.com/vulnerabilities/56351 · Nota
• http://drupal.org/node/711072 · Correção
• http://drupal.org/node/717214 · Aviso do Fabricante
• http://osvdb.org/62405 · Nota