CVE-2010-3094: Drupal cross-site scripting vulnerability via actions feature and trigger module
Drupal cross-site scripting vulnerability via actions feature and trigger module
Other sources
Multiple cross-site scripting (XSS) vulnerabilities in Drupal 6.x before 6.18 allow remote authenticated users with certain privileges to inject arbitrary web script or HTML via (1) an action description, (2) an action message, (3) a node, or (4) a taxonomy term, related to the actions feature and the trigger module.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/drupal/drupalto a version that resolves this vulnerability.Fixed in 6.18
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3094?
CVE-2010-3094 has been classified as a moderate severity vulnerability due to cross-site scripting risks.
How do I fix CVE-2010-3094?
To fix CVE-2010-3094, upgrade your Drupal installation to version 6.18 or later.
Who is affected by CVE-2010-3094?
CVE-2010-3094 affects Drupal versions prior to 6.18, including versions 6.0 to 6.17.
What types of vulnerabilities are associated with CVE-2010-3094?
CVE-2010-3094 is associated with multiple cross-site scripting (XSS) vulnerabilities.
Can authenticated users exploit CVE-2010-3094?
Yes, authenticated users with certain privileges can exploit CVE-2010-3094.