PT-2019-6545 · Drupal · Drupal

Jan Lieskovsky · Publicado 2019-11-07 · Atualizado 2019-11-13 · CVE-2010-2472

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Drupal versions 6.x prior to 6.16 Drupal versions 5.x prior to 5.22

Description The Locale module and its dependent contributed modules in Drupal do not properly sanitize the display of language codes, native, and English language names. This could allow an attacker to perform a cross-site scripting (XSS) attack. However, the vulnerability is mitigated by the requirement that an attacker must have a role with the administer languages permission.

Recommendations For versions 6.x prior to 6.16, update to version 6.16 or later. For versions 5.x prior to 5.22, update to version 5.22 or later.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2010-2472

DSA-2016-1

Produtos afetados

Drupal

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2010-2472 · Nota de Segurança
• https://security-tracker.debian.org/tracker/CVE-2010-2472 · Aviso do Fabricante
• https://openwall.com/lists/oss-security/2010/06/28/8 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2472 · Nota
• https://drupal.org/node/731710 · Aviso do Fabricante
• https://t.me/cibsecurity/8087 · Publicação no Telegram