CVE-2010-2048

Multiple cross-site scripting (XSS) vulnerabilities in the Heartbeat module 6.x before 6.x-4.9 for Drupal allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.

CVSS v2.0 3.5 LOW

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:N/I:P/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://drupal.org/node/802508	Patch
http://drupal.org/node/803570	Patch Vendor Advisory
http://secunia.com/advisories/39893	Vendor Advisory
http://www.securityfocus.com/bid/40268	Patch
https://exchange.xforce.ibmcloud.com/vulnerabilities/58702

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:menhir:heartbeat:6.x-2.3:::::::*
	cpe:2.3:a:menhir:heartbeat:6.x-2.3:beta1::::::
	cpe:2.3:a:menhir:heartbeat:6.x-2.3:beta2::::::
	cpe:2.3:a:menhir:heartbeat:6.x-3.2:::::::*
	cpe:2.3:a:menhir:heartbeat:6.x-3.3:::::::*
	cpe:2.3:a:menhir:heartbeat:6.x-3.x:dev::::::
	cpe:2.3:a:menhir:heartbeat:6.x-4.0:::::::*
	cpe:2.3:a:menhir:heartbeat:6.x-4.1:::::::*
	cpe:2.3:a:menhir:heartbeat:6.x-4.2:::::::*
	cpe:2.3:a:menhir:heartbeat:6.x-4.3:::::::*
	cpe:2.3:a:menhir:heartbeat:6.x-4.3:beta1::::::
	cpe:2.3:a:menhir:heartbeat:6.x-4.3:beta2::::::
	cpe:2.3:a:menhir:heartbeat:6.x-4.3:beta3::::::
	cpe:2.3:a:menhir:heartbeat:6.x-4.4:::::::*
	cpe:2.3:a:menhir:heartbeat:6.x-4.5:::::::*
	cpe:2.3:a:menhir:heartbeat:6.x-4.6:::::::*
	cpe:2.3:a:menhir:heartbeat:6.x-4.7:::::::*
	cpe:2.3:a:menhir:heartbeat:6.x-4.8:::::::*
	cpe:2.3:a:menhir:heartbeat:6.x-4.x:dev::::::

cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2010-05-25 18:30

Updated : 2024-02-04 17:54

NVD link : CVE-2010-2048

Mitre link : CVE-2010-2048

CVE.ORG link : CVE-2010-2048

JSON object : View

Products Affected

drupal

drupal

menhir

heartbeat

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2010-2048", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2010-05-25T18:30:01.907", "references": [{"url": "http://drupal.org/node/802508", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://drupal.org/node/803570", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/39893", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/40268", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/58702", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Multiple cross-site scripting (XSS) vulnerabilities in the Heartbeat module 6.x before 6.x-4.9 for Drupal allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en el m\u00f3dulo Heartbeat v6.x anterior a v6.x-4.9 para Drupal permite a usuarios autenticados remotamente inyectar secuencias de comandos web o HTML de su elecci\u00f3n a trav\u00e9s de vectores no especificados."}], "lastModified": "2017-08-17T01:32:35.807", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:menhir:heartbeat:6.x-2.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B9C59957-24F2-4840-B6A3-4070147B08A3"}, {"criteria": "cpe:2.3:a:menhir:heartbeat:6.x-2.3:beta1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D9373B26-896D-424A-B787-2FFEBD37FDF7"}, {"criteria": "cpe:2.3:a:menhir:heartbeat:6.x-2.3:beta2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5CD694C5-88EC-4CBD-BF94-8A948C5A77F6"}, {"criteria": "cpe:2.3:a:menhir:heartbeat:6.x-3.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0FCA715C-459E-492B-AAFB-DE307FF21014"}, {"criteria": "cpe:2.3:a:menhir:heartbeat:6.x-3.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2098F13B-21F7-46DB-AB93-9B5AD0F87FB7"}, {"criteria": "cpe:2.3:a:menhir:heartbeat:6.x-3.x:dev:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0BD6C97B-C0C7-4109-80C2-08E9277C27D5"}, {"criteria": "cpe:2.3:a:menhir:heartbeat:6.x-4.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2F5B34A5-DCDD-45C7-A131-7B1CB98C95CD"}, {"criteria": "cpe:2.3:a:menhir:heartbeat:6.x-4.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "978CE240-9FE9-431E-AA02-4FD94C50A696"}, {"criteria": "cpe:2.3:a:menhir:heartbeat:6.x-4.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "35485305-9ED5-4B7B-A859-0DA26C7219D8"}, {"criteria": "cpe:2.3:a:menhir:heartbeat:6.x-4.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C60F9078-326D-40A9-8C52-399AA3CE3D35"}, {"criteria": "cpe:2.3:a:menhir:heartbeat:6.x-4.3:beta1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D52AE35F-AA51-4255-BEC8-71E9577F798B"}, {"criteria": "cpe:2.3:a:menhir:heartbeat:6.x-4.3:beta2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D9AFC586-D802-4C17-A515-721F304A8664"}, {"criteria": "cpe:2.3:a:menhir:heartbeat:6.x-4.3:beta3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EBD231B3-67FD-4431-996A-DE47A47A870F"}, {"criteria": "cpe:2.3:a:menhir:heartbeat:6.x-4.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8A5EB9E7-68D2-4FC7-AD0A-C6ADBB0F8529"}, {"criteria": "cpe:2.3:a:menhir:heartbeat:6.x-4.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FBDA963E-87DA-4B1B-990A-B7656DB9504B"}, {"criteria": "cpe:2.3:a:menhir:heartbeat:6.x-4.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9D72C7D4-82C0-432F-A1BB-00763B9A4F1A"}, {"criteria": "cpe:2.3:a:menhir:heartbeat:6.x-4.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6F8A0215-9DB1-486E-9A1E-B7AF6CF8354D"}, {"criteria": "cpe:2.3:a:menhir:heartbeat:6.x-4.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8FDCEA90-7885-475B-88CE-13992497B201"}, {"criteria": "cpe:2.3:a:menhir:heartbeat:6.x-4.x:dev:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "80004B70-BD68-4C34-9E88-3F1C3261B7C2"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "799CA80B-F3FA-4183-A791-2071A7DA1E54"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "cve@mitre.org"}