VulnerabilityModified

CVE-2010-2123

LOW 2.1EPSS 1.51%

Does this matter?

Lower severity and a low EPSS score (1.51%). Track it; it rarely justifies an emergency change on its own.

Description

Multiple cross-site scripting (XSS) vulnerabilities in the Storm module 5.x and 6.x before 6.x-1.33 for Drupal allow remote authenticated users, with certain module privileges, to inject arbitrary web script or HTML via the (1) fullname, (2) address, (3) city, (4) provstate (aka state), (5) phone, or (6) taxid parameter in a stormorganization action to index.php; the (7) name parameter in a stormperson action to index.php; the (8) stepno (aka Step no.) or (9) title parameter in a stormtask action to index.php; the (10) title (aka Project) parameter in a stormticket action to index.php; or (11) unspecified parameters in a stormproject action to index.php. NOTE: some of these details are obtained from third party information.

CVSS 2.0: 2.1 LOWAV:N/AC:H/Au:S/C:N/I:P/A:N
EPSS: 1.51% probability · 73th percentile
CISA KEV: Not listed
Weakness: CWE-79
Affected: speedtech/storm
Source: cve@mitre.org

References

http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0160.htmlExploit
http://drupal.org/node/803770Patch, Vendor Advisory
http://secunia.com/advisories/39732Vendor Advisory
http://www.osvdb.org/64616
http://www.securityfocus.com/bid/40288Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/58717
http://archives.neohapsis.com/archives/fulldisclosure/2010-05/0160.htmlExploit
http://drupal.org/node/803770Patch, Vendor Advisory
http://secunia.com/advisories/39732Vendor Advisory
http://www.osvdb.org/64616
http://www.securityfocus.com/bid/40288Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/58717

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.