PT-2019-6545 · Drupal · Drupal

Jan Lieskovsky · Published 2019-11-07 · Updated 2019-11-13 · CVE-2010-2472

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Drupal versions 6.x prior to 6.16 Drupal versions 5.x prior to 5.22

Description The Locale module and its dependent contributed modules in Drupal do not properly sanitize the display of language codes, native, and English language names. This could allow an attacker to perform a cross-site scripting (XSS) attack. However, the vulnerability is mitigated by the requirement that an attacker must have a role with the administer languages permission.

Recommendations For versions 6.x prior to 6.16, update to version 6.16 or later. For versions 5.x prior to 5.22, update to version 5.22 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2010-2472

DSA-2016-1

Affected Products

Drupal

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2010-2472 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2010-2472 · Vendor Advisory
• https://drupal.org/node/731710 · Vendor Advisory
• https://openwall.com/lists/oss-security/2010/06/28/8 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-2472 · Note
• https://t.me/cibsecurity/8087 · Telegram Post