PT-2010-3733 · Drupal · Drupal Storm

Publicado 2010-06-01 · Atualizado 2017-08-17 · CVE-2010-2123

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Baixa

Vetor base

AV:N/AC:H/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Drupal Storm module versions 5.x through 6.x-1.32

Description The issue allows remote authenticated users with certain module privileges to inject arbitrary web script or HTML. This can be achieved via various parameters in different actions to index.php, including fullname, address, city, provstate, phone, taxid, name, stepno, title, and unspecified parameters in stormproject actions.

Recommendations For Drupal Storm module versions 5.x through 6.x-1.32, update to version 6.x-1.33 or later to resolve the issue.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2010-2123

Produtos afetados

Drupal Storm

Referências · 7

• 🔥 http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0160.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2010-2123 · Nota de Segurança
• http://securityfocus.com/bid/40288 · Correção
• http://drupal.org/node/803770 · Aviso do Fabricante
• http://secunia.com/advisories/39732 · Aviso do Fabricante
• http://osvdb.org/64616 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/58717 · Nota