Lucene search

[email protected]CVE-2010-0697

HistoryFeb 23, 2010 - 8:30 p.m.

CVE-2010-0697

2010-02-2320:30:00

CWE-79

[email protected]

web.nvd.nist.gov

cve-2010-0697

cross-site scripting

xss

itweak upload

drupal

vulnerability

nvd

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

5.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

44.7%

JSON

Cross-site scripting (XSS) vulnerability in the iTweak Upload module 6.x-1.x before 6.x-1.2 and 6.x-2.x before 6.x-2.3 for Drupal allows remote authenticated users, with create content and upload file permissions, to inject arbitrary web script or HTML via the file name of an uploaded file.

Affected configurations

NVD

Node

ilya_ivanchenkoitweak_uploadMatch6.x-1.0

ilya_ivanchenkoitweak_uploadMatch6.x-1.1

ilya_ivanchenkoitweak_uploadMatch6.x-1.x-dev

ilya_ivanchenkoitweak_uploadMatch6.x-2.0rc1

ilya_ivanchenkoitweak_uploadMatch6.x-2.1

ilya_ivanchenkoitweak_uploadMatch6.x-2.1rc2

ilya_ivanchenkoitweak_uploadMatch6.x-2.2

ilya_ivanchenkoitweak_uploadMatch6.x-2.x-dev

AND

drupaldrupal

CPENameOperatorVersion
ilya_ivanchenko:itweak_uploadilya ivanchenko itweak uploadeq6.x-1.0
ilya_ivanchenko:itweak_uploadilya ivanchenko itweak uploadeq6.x-1.1
ilya_ivanchenko:itweak_uploadilya ivanchenko itweak uploadeq6.x-1.x-dev
ilya_ivanchenko:itweak_uploadilya ivanchenko itweak uploadeq6.x-2.0
ilya_ivanchenko:itweak_uploadilya ivanchenko itweak uploadeq6.x-2.1
ilya_ivanchenko:itweak_uploadilya ivanchenko itweak uploadeq6.x-2.2
ilya_ivanchenko:itweak_uploadilya ivanchenko itweak uploadeq6.x-2.x-dev

CPE	Name	Operator	Version
ilya_ivanchenko:itweak_upload	ilya ivanchenko itweak upload	eq	6.x-1.0
ilya_ivanchenko:itweak_upload	ilya ivanchenko itweak upload	eq	6.x-1.1
ilya_ivanchenko:itweak_upload	ilya ivanchenko itweak upload	eq	6.x-1.x-dev
ilya_ivanchenko:itweak_upload	ilya ivanchenko itweak upload	eq	6.x-2.0
ilya_ivanchenko:itweak_upload	ilya ivanchenko itweak upload	eq	6.x-2.1
ilya_ivanchenko:itweak_upload	ilya ivanchenko itweak upload	eq	6.x-2.2
ilya_ivanchenko:itweak_upload	ilya ivanchenko itweak upload	eq	6.x-2.x-dev

References

drupal.org/node/711072

drupal.org/node/711074

drupal.org/node/717214

osvdb.org/62405

secunia.com/advisories/38633

www.securityfocus.com/bid/38292

exchange.xforce.ibmcloud.com/vulnerabilities/56351

3.5 Low

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

5.5 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

44.7%

JSON

Related for CVE-2010-0697

prion1 nvd1 cvelist1