Locale module and dependent contributed modules in Drupal 6.x before 6.16 and 5.x before version 5.22 do not sanitize the display of language codes, native and English language names properly which could allow an attacker to perform a cross-site scripting (XSS) attack. This vulnerability is mitigated by the fact that an attacker must have a role with the 'administer languages' permission.
References
| Link | Resource |
|---|---|
| https://security-tracker.debian.org/tracker/CVE-2010-2472 | Third Party Advisory |
| https://www.drupal.org/node/731710 | Patch Vendor Advisory |
| https://www.openwall.com/lists/oss-security/2010/06/28/8 | Mailing List Third Party Advisory |
| https://security-tracker.debian.org/tracker/CVE-2010-2472 | Third Party Advisory |
| https://www.drupal.org/node/731710 | Patch Vendor Advisory |
| https://www.openwall.com/lists/oss-security/2010/06/28/8 | Mailing List Third Party Advisory |
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 01:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://security-tracker.debian.org/tracker/CVE-2010-2472 - Third Party Advisory | |
| References | () https://www.drupal.org/node/731710 - Patch, Vendor Advisory | |
| References | () https://www.openwall.com/lists/oss-security/2010/06/28/8 - Mailing List, Third Party Advisory |
Information
Published : 2019-11-07 19:15
Updated : 2024-11-21 01:16
NVD link : CVE-2010-2472
Mitre link : CVE-2010-2472
CVE.ORG link : CVE-2010-2472
JSON object : View
Products Affected
drupal
- drupal
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')