CVE-2010-2123: XSS
First published: Tue Jun 01 2010(Updated: )
Multiple cross-site scripting (XSS) vulnerabilities in the Storm module 5.x and 6.x before 6.x-1.33 for Drupal allow remote authenticated users, with certain module privileges, to inject arbitrary web script or HTML via the (1) fullname, (2) address, (3) city, (4) provstate (aka state), (5) phone, or (6) taxid parameter in a stormorganization action to index.php; the (7) name parameter in a stormperson action to index.php; the (8) stepno (aka Step no.) or (9) title parameter in a stormtask action to index.php; the (10) title (aka Project) parameter in a stormticket action to index.php; or (11) unspecified parameters in a stormproject action to index.php. NOTE: some of these details are obtained from third party information.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Speedtech Storm | =5.x-1.1 | |
| Speedtech Storm | =5.x-1.2 | |
| Speedtech Storm | =5.x-1.3 | |
| Speedtech Storm | =5.x-1.4 | |
| Speedtech Storm | =5.x-1.5 | |
| Speedtech Storm | =5.x-1.6 | |
| Speedtech Storm | =5.x-1.7 | |
| Speedtech Storm | =5.x-1.8 | |
| Speedtech Storm | =5.x-1.9 | |
| Speedtech Storm | =5.x-1.10 | |
| Speedtech Storm | =5.x-1.11 | |
| Speedtech Storm | =5.x-1.12 | |
| Speedtech Storm | =5.x-1.13 | |
| Speedtech Storm | =5.x-1.14 | |
| Speedtech Storm | =5.x-1.x-dev | |
| Drupal | ||
| Speedtech Storm | =6.x-1.0 | |
| Speedtech Storm | =6.x-1.1 | |
| Speedtech Storm | =6.x-1.2 | |
| Speedtech Storm | =6.x-1.3 | |
| Speedtech Storm | =6.x-1.4 | |
| Speedtech Storm | =6.x-1.5 | |
| Speedtech Storm | =6.x-1.6 | |
| Speedtech Storm | =6.x-1.7 | |
| Speedtech Storm | =6.x-1.8 | |
| Speedtech Storm | =6.x-1.9 | |
| Speedtech Storm | =6.x-1.10 | |
| Speedtech Storm | =6.x-1.11 | |
| Speedtech Storm | =6.x-1.12 | |
| Speedtech Storm | =6.x-1.13 | |
| Speedtech Storm | =6.x-1.14 | |
| Speedtech Storm | =6.x-1.15 | |
| Speedtech Storm | =6.x-1.16 | |
| Speedtech Storm | =6.x-1.17 | |
| Speedtech Storm | =6.x-1.18 | |
| Speedtech Storm | =6.x-1.19 | |
| Speedtech Storm | =6.x-1.20 | |
| Speedtech Storm | =6.x-1.21 | |
| Speedtech Storm | =6.x-1.22 | |
| Speedtech Storm | =6.x-1.23 | |
| Speedtech Storm | =6.x-1.24 | |
| Speedtech Storm | =6.x-1.25 | |
| Speedtech Storm | =6.x-1.26 | |
| Speedtech Storm | =6.x-1.27 | |
| Speedtech Storm | =6.x-1.28 | |
| Speedtech Storm | =6.x-1.29 | |
| Speedtech Storm | =6.x-1.30 | |
| Speedtech Storm | =6.x-1.31 | |
| Speedtech Storm | =6.x-1.32 | |
| Speedtech Storm | =6.x-1.x-dev | |
| All of | ||
| Any of | ||
| Speedtech Storm | =5.x-1.1 | |
| Speedtech Storm | =5.x-1.2 | |
| Speedtech Storm | =5.x-1.3 | |
| Speedtech Storm | =5.x-1.4 | |
| Speedtech Storm | =5.x-1.5 | |
| Speedtech Storm | =5.x-1.6 | |
| Speedtech Storm | =5.x-1.7 | |
| Speedtech Storm | =5.x-1.8 | |
| Speedtech Storm | =5.x-1.9 | |
| Speedtech Storm | =5.x-1.10 | |
| Speedtech Storm | =5.x-1.11 | |
| Speedtech Storm | =5.x-1.12 | |
| Speedtech Storm | =5.x-1.13 | |
| Speedtech Storm | =5.x-1.14 | |
| Speedtech Storm | =5.x-1.x-dev | |
| Drupal | ||
| All of | ||
| Any of | ||
| Speedtech Storm | =6.x-1.0 | |
| Speedtech Storm | =6.x-1.1 | |
| Speedtech Storm | =6.x-1.2 | |
| Speedtech Storm | =6.x-1.3 | |
| Speedtech Storm | =6.x-1.4 | |
| Speedtech Storm | =6.x-1.5 | |
| Speedtech Storm | =6.x-1.6 | |
| Speedtech Storm | =6.x-1.7 | |
| Speedtech Storm | =6.x-1.8 | |
| Speedtech Storm | =6.x-1.9 | |
| Speedtech Storm | =6.x-1.10 | |
| Speedtech Storm | =6.x-1.11 | |
| Speedtech Storm | =6.x-1.12 | |
| Speedtech Storm | =6.x-1.13 | |
| Speedtech Storm | =6.x-1.14 | |
| Speedtech Storm | =6.x-1.15 | |
| Speedtech Storm | =6.x-1.16 | |
| Speedtech Storm | =6.x-1.17 | |
| Speedtech Storm | =6.x-1.18 | |
| Speedtech Storm | =6.x-1.19 | |
| Speedtech Storm | =6.x-1.20 | |
| Speedtech Storm | =6.x-1.21 | |
| Speedtech Storm | =6.x-1.22 | |
| Speedtech Storm | =6.x-1.23 | |
| Speedtech Storm | =6.x-1.24 | |
| Speedtech Storm | =6.x-1.25 | |
| Speedtech Storm | =6.x-1.26 | |
| Speedtech Storm | =6.x-1.27 | |
| Speedtech Storm | =6.x-1.28 | |
| Speedtech Storm | =6.x-1.29 | |
| Speedtech Storm | =6.x-1.30 | |
| Speedtech Storm | =6.x-1.31 | |
| Speedtech Storm | =6.x-1.32 | |
| Speedtech Storm | =6.x-1.x-dev | |
| Drupal |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2010-2123?
CVE-2010-2123 is considered critical due to its potential to allow remote authenticated users to execute arbitrary web scripts or HTML.
How do I fix CVE-2010-2123?
To fix CVE-2010-2123, update the Storm module to version 6.x-1.33 or later for Drupal.
What systems are affected by CVE-2010-2123?
CVE-2010-2123 affects Speedtech Storm module versions 5.x-1.1 through 5.x-1.32 and 6.x-1.0 through 6.x-1.32 for Drupal.
Who can exploit CVE-2010-2123?
CVE-2010-2123 can be exploited by remote authenticated users who have specific module privileges.
What type of vulnerability is CVE-2010-2123?
CVE-2010-2123 is classified as a Cross-Site Scripting (XSS) vulnerability.
- collector/nvd-historical
- agent/references
- agent/type
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/author
- agent/severity
- agent/description
- agent/first-publish-date
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/speedtech
- canonical/speedtech storm
- version/speedtech storm/5.x-1.1
- version/speedtech storm/5.x-1.2
- version/speedtech storm/5.x-1.3
- version/speedtech storm/5.x-1.4
- version/speedtech storm/5.x-1.5
- version/speedtech storm/5.x-1.6
- version/speedtech storm/5.x-1.7
- version/speedtech storm/5.x-1.8
- version/speedtech storm/5.x-1.9
- version/speedtech storm/5.x-1.10
- version/speedtech storm/5.x-1.11
- version/speedtech storm/5.x-1.12
- version/speedtech storm/5.x-1.13
- version/speedtech storm/5.x-1.14
- version/speedtech storm/5.x-1.x-dev
- vendor/drupal
- canonical/drupal
- version/speedtech storm/6.x-1.0
- version/speedtech storm/6.x-1.1
- version/speedtech storm/6.x-1.2
- version/speedtech storm/6.x-1.3
- version/speedtech storm/6.x-1.4
- version/speedtech storm/6.x-1.5
- version/speedtech storm/6.x-1.6
- version/speedtech storm/6.x-1.7
- version/speedtech storm/6.x-1.8
- version/speedtech storm/6.x-1.9
- version/speedtech storm/6.x-1.10
- version/speedtech storm/6.x-1.11
- version/speedtech storm/6.x-1.12
- version/speedtech storm/6.x-1.13
- version/speedtech storm/6.x-1.14
- version/speedtech storm/6.x-1.15
- version/speedtech storm/6.x-1.16
- version/speedtech storm/6.x-1.17
- version/speedtech storm/6.x-1.18
- version/speedtech storm/6.x-1.19
- version/speedtech storm/6.x-1.20
- version/speedtech storm/6.x-1.21
- version/speedtech storm/6.x-1.22
- version/speedtech storm/6.x-1.23
- version/speedtech storm/6.x-1.24
- version/speedtech storm/6.x-1.25
- version/speedtech storm/6.x-1.26
- version/speedtech storm/6.x-1.27
- version/speedtech storm/6.x-1.28
- version/speedtech storm/6.x-1.29
- version/speedtech storm/6.x-1.30
- version/speedtech storm/6.x-1.31
- version/speedtech storm/6.x-1.32
- version/speedtech storm/6.x-1.x-dev