CVE-2010-1584

Cross-site scripting (XSS) vulnerability in the Context module before 6.x-2.0-rc4 for Drupal allows remote authenticated users, with Administer Blocks privileges, to inject arbitrary web script or HTML via a block description.

CVSS v2.0 2.1 LOW

2.1^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:H/Au:S/C:N/I:P/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://crackingdrupal.com/blog/greggles/mitigation-against-cve-2010-1584-drupal-context-module-xss
http://drupal.org/cvs?commit=365210
http://drupal.org/node/794718
http://drupal.org/node/795118	Patch
http://www.madirish.net/?article=457
http://www.packetstormsecurity.com/1005-exploits/drupalab-xss.txt	Exploit
http://www.securityfocus.com/bid/40056
http://www.theregister.co.uk/2010/05/10/drupal_security_bug/
https://exchange.xforce.ibmcloud.com/vulnerabilities/58521

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:steven_jones:context::rc3::::::*
	cpe:2.3:a:steven_jones:context:6.x-2.0:alpha1::::::
	cpe:2.3:a:steven_jones:context:6.x-2.0:alpha2::::::
	cpe:2.3:a:steven_jones:context:6.x-2.0:beta1::::::
	cpe:2.3:a:steven_jones:context:6.x-2.0:beta2::::::
	cpe:2.3:a:steven_jones:context:6.x-2.0:beta3::::::
	cpe:2.3:a:steven_jones:context:6.x-2.0:beta4::::::
	cpe:2.3:a:steven_jones:context:6.x-2.0:beta5::::::
	cpe:2.3:a:steven_jones:context:6.x-2.0:beta6::::::
	cpe:2.3:a:steven_jones:context:6.x-2.0:beta7::::::
	cpe:2.3:a:steven_jones:context:6.x-2.0:rc1::::::
	cpe:2.3:a:steven_jones:context:6.x-2.0:rc2::::::

cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2010-05-19 12:08

Updated : 2017-08-17 01:32

NVD link : CVE-2010-1584

Mitre link : CVE-2010-1584

CVE.ORG link : CVE-2010-1584

JSON object : View

Products Affected

drupal

drupal

steven_jones

context

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2010-1584", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2010-05-19T12:08:08.193", "references": [{"url": "http://crackingdrupal.com/blog/greggles/mitigation-against-cve-2010-1584-drupal-context-module-xss", "source": "cve@mitre.org"}, {"url": "http://drupal.org/cvs?commit=365210", "source": "cve@mitre.org"}, {"url": "http://drupal.org/node/794718", "source": "cve@mitre.org"}, {"url": "http://drupal.org/node/795118", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://www.madirish.net/?article=457", "source": "cve@mitre.org"}, {"url": "http://www.packetstormsecurity.com/1005-exploits/drupalab-xss.txt", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/40056", "source": "cve@mitre.org"}, {"url": "http://www.theregister.co.uk/2010/05/10/drupal_security_bug/", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/58521", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in the Context module before 6.x-2.0-rc4 for Drupal allows remote authenticated users, with Administer Blocks privileges, to inject arbitrary web script or HTML via a block description."}, {"lang": "es", "value": "Vulnerabilidad de ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) en el m\u00f3dulo Context anterior a v6.x-2.0-rc4 para Drupal permite a usuarios autenticados remotamente, con privilegios \"Administer Blocks\", inyectar c\u00f3digo web o HTML a trav\u00e9s de una descripci\u00f3n \"block\"."}], "lastModified": "2017-08-17T01:32:24.853", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:steven_jones:context:*:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4DD2CCED-EEF0-4F89-812A-401736B46244", "versionEndIncluding": "6.x-2.0"}, {"criteria": "cpe:2.3:a:steven_jones:context:6.x-2.0:alpha1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A5502A2B-D8D1-4BC9-8902-C9F9A8C2AF6F"}, {"criteria": "cpe:2.3:a:steven_jones:context:6.x-2.0:alpha2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2B2438DF-817D-46D4-885D-CF6052BF4166"}, {"criteria": "cpe:2.3:a:steven_jones:context:6.x-2.0:beta1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FBF39898-9E79-4B1C-BC00-B37CCA30088B"}, {"criteria": "cpe:2.3:a:steven_jones:context:6.x-2.0:beta2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "3BA71873-1CCC-4447-8C98-31FDA002AAEA"}, {"criteria": "cpe:2.3:a:steven_jones:context:6.x-2.0:beta3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7DFE54DF-B6F2-4ECF-9283-DA3836D1DDAB"}, {"criteria": "cpe:2.3:a:steven_jones:context:6.x-2.0:beta4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4274C682-9E48-432D-9CA2-5CDB054864DD"}, {"criteria": "cpe:2.3:a:steven_jones:context:6.x-2.0:beta5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EBBBDCEA-521C-46D1-9A35-2EA3234A3E6A"}, {"criteria": "cpe:2.3:a:steven_jones:context:6.x-2.0:beta6:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "68C704EE-E219-453C-BFE5-2B1E607B588A"}, {"criteria": "cpe:2.3:a:steven_jones:context:6.x-2.0:beta7:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "26EA9E05-CE12-4D64-A766-ED60D20C3923"}, {"criteria": "cpe:2.3:a:steven_jones:context:6.x-2.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "903398AF-285F-4255-95B7-3FE4270AECF1"}, {"criteria": "cpe:2.3:a:steven_jones:context:6.x-2.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F892763E-1C37-46D9-9DE3-3FC73F11F628"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "799CA80B-F3FA-4183-A791-2071A7DA1E54"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}