SB2019110660 - Multiple vulnerabilities in Drupal Drupal

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2019110660

SB2019110660 - Multiple vulnerabilities in Drupal Drupal

Published: November 6, 2019 Updated: July 17, 2020

Security Bulletin ID SB2019110660
Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 25% Low 75%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 secuirty vulnerabilities.


1) Cross-site scripting (CVE-ID: CVE-2010-2472)

The vulnerability allows a remote privileged user to read and manipulate data.

Locale module and dependent contributed modules in Drupal 6.x before 6.16 and 5.x before version 5.22 do not sanitize the display of language codes, native and English language names properly which could allow an attacker to perform a cross-site scripting (XSS) attack. This vulnerability is mitigated by the fact that an attacker must have a role with the 'administer languages' permission.


2) Input validation error (CVE-ID: CVE-2010-2473)

The vulnerability allows a remote authenticated user to manipulate data.

Drupal 6.x before 6.16 and 5.x before version 5.22 does not properly block users under certain circumstances. A user with an open session that was blocked could maintain their session on the Drupal site despite being blocked.


3) Cross-site scripting (CVE-ID: CVE-2010-2250)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

Drupal 6.x before 6.16 uses a user-supplied value in output during site installation which could allow an attacker to craft a URL and perform a cross-site scripting attack.


4) Open redirect (CVE-ID: CVE-2010-2471)

The vulnerability allows a remote non-authenticated attacker to read and manipulate data.

drupal6 version 6.16 has open redirection


Remediation

Install update from vendor's website.

References