CVE-2010-2472

State: Published
Severity: Not scored
Published: Nov 7, 2019
Updated: Aug 7, 2024
Reserved: Jun 28, 2010

Description

Locale module and dependent contributed modules in Drupal 6.x before 6.16 and 5.x before version 5.22 do not sanitize the display of language codes, native and English language names properly which could allow an attacker to perform a cross-site scripting (XSS) attack. This vulnerability is mitigated by the fact that an attacker must have a role with the 'administer languages' permission.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
drupal6drupal6	6.x before version 6.16Affected 5.x before version 5.22Affected

References

https://security-tracker.debian.org/tracker/CVE-2010-2472
https://www.drupal.org/node/731710
MLIST: [oss-security] 20100628 Re: CVE Request -- Drupal v6.16 / v5.22 SA-CORE-2010-001mailing-list

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.