CVE-2010-2250

Drupal 5.x and 6.x before 6.16 uses a user-supplied value in output during site installation which could allow an attacker to craft a URL and perform a cross-site scripting attack.

Score

CVSS 3.1 6.1 Medium

Status

Modified - secalert@redhat.com

Published

2019-11-07

Last modified

2024-08-07

Weaknesses

CWE-79

Affected products

• Drupal (Drupal)
• Drupal6 (Drupal6)

References

• http://www.openwall.com/lists/oss-security/2014/02/12/8
• https://security-tracker.debian.org/tracker/CVE-2010-2250
• https://www.drupal.org/node/731710
• https://www.openwall.com/lists/oss-security/2010/06/28/8