Lucene search

[email protected]CVE-2010-2250

HistoryNov 07, 2019 - 6:15 p.m.

CVE-2010-2250

2019-11-0718:15:11

CWE-79

[email protected]

web.nvd.nist.gov

cve-2010-2250

drupal

cross-site scripting

xss

vulnerability

nvd

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.3 Medium

CVSS2

Access Vector

Access Complexity

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:N/C:N/I:P/A:N

0.002 Low

EPSS

Percentile

56.7%

JSON

Drupal 5.x and 6.x before 6.16 uses a user-supplied value in output during site installation which could allow an attacker to craft a URL and perform a cross-site scripting attack.

Affected configurations

Vulners

NVD

Node

drupal6drupal6Range6.0–6.16

CPENameOperatorVersion
drupal:drupaldrupallt5.22
drupal:drupaldrupallt6.16

CPE	Name	Operator	Version
drupal:drupal	drupal	lt	5.22
drupal:drupal	drupal	lt	6.16

CNA Affected

[
  {
    "product": "drupal6",
    "vendor": "drupal6",
    "versions": [
      {
        "status": "affected",
        "version": "6.x before version 6.16"
      }
    ]
  }
]