CVE-2010-2123: XSS
Multiple cross-site scripting (XSS) vulnerabilities in the Storm module 5.x and 6.x before 6.x-1.33 for Drupal allow remote authenticated users, with certain module privileges, to inject arbitrary web script or HTML via the (1) fullname, (2) address, (3) city, (4) provstate (aka state), (5) phone, or (6) taxid parameter in a stormorganization action to index.php; the (7) name parameter in a stormperson action to index.php; the (8) stepno (aka Step no.) or (9) title parameter in a stormtask action to index.php; the (10) title (aka Project) parameter in a stormticket action to index.php; or (11) unspecified parameters in a stormproject action to index.php. NOTE: some of these details are obtained from third party information.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-2123?
CVE-2010-2123 is considered critical due to its potential to allow remote authenticated users to execute arbitrary web scripts or HTML.
How do I fix CVE-2010-2123?
To fix CVE-2010-2123, update the Storm module to version 6.x-1.33 or later for Drupal.
What systems are affected by CVE-2010-2123?
CVE-2010-2123 affects Speedtech Storm module versions 5.x-1.1 through 5.x-1.32 and 6.x-1.0 through 6.x-1.32 for Drupal.
Who can exploit CVE-2010-2123?
CVE-2010-2123 can be exploited by remote authenticated users who have specific module privileges.
What type of vulnerability is CVE-2010-2123?
CVE-2010-2123 is classified as a Cross-Site Scripting (XSS) vulnerability.