CVEvulnerability
CVE-2010-2472
4.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2019-11-07
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 4.8 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 3.5 LOW — AV:N/AC:M/Au:S/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
Locale module and dependent contributed modules in Drupal 6.x before 6.16 and 5.x before version 5.22 do not sanitize the display of language codes, native and English language names properly which could allow an attacker to perform a cross-site scripting (XSS) attack. This vulnerability is mitigated by the fact that an attacker must have a role with the 'administer languages' permission.
Affected configurations
• drupal drupal (>= 5.0 < 5.22)
• drupal drupal (>= 6.0 < 6.16)
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://security-tracker.debian.org/tracker/CVE-2010-2472 Third Party Advisory
- https://www.drupal.org/node/731710 Patch, Vendor Advisory
- https://www.openwall.com/lists/oss-security/2010/06/28/8 Mailing List, Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2010-2472 Third Party Advisory
- https://www.drupal.org/node/731710 Patch, Vendor Advisory
- https://www.openwall.com/lists/oss-security/2010/06/28/8 Mailing List, Third Party Advisory