CVE-2010-4520: XSS
Published Dec 23, 2010
·Updated
Multiple cross-site scripting (XSS) vulnerabilities in the Views module 6.x before 6.x-2.11 for Drupal allow remote attackers to inject arbitrary web script or HTML via (1) a URL or (2) an aggregator feed title.
Affected Software
31 affected components
Earl Miles Views=6.x-2.0
Earl Miles Views=6.x-2.0-alpha1
Earl Miles Views=6.x-2.0-alpha2
Earl Miles Views=6.x-2.0-alpha3
Earl Miles Views=6.x-2.0-alpha4
Earl Miles Views=6.x-2.0-alpha5
Earl Miles Views=6.x-2.0-beta1
Earl Miles Views=6.x-2.0-beta2
Earl Miles Views=6.x-2.0-beta3
Earl Miles Views=6.x-2.0-beta4
Earl Miles Views=6.x-2.0-rc1
Earl Miles Views=6.x-2.0-rc2
Earl Miles Views=6.x-2.0-rc3
Earl Miles Views=6.x-2.0-rc4
Earl Miles Views=6.x-2.0-rc5
Earl Miles Views=6.x-2.1
Earl Miles Views=6.x-2.2
Earl Miles Views=6.x-2.3
Earl Miles Views=6.x-2.4
Earl Miles Views=6.x-2.5
Earl Miles Views=6.x-2.6
Earl Miles Views=6.x-2.7
Earl Miles Views=6.x-2.8
Earl Miles Views=6.x-2.9
Earl Miles Views=6.x-2.10
Earl Miles Views=6.x-2.x-dev
Earl Miles Views=6.x-3.0-alpha1
Earl Miles Views=6.x-3.0-alpha2
Earl Miles Views=6.x-3.0-alpha3
Earl Miles Views=6.x-3.x-dev
Drupal Drupal
Remediation
Patch Available
Patch Available
Patch Available
Event History
Dec 23, 2010
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Data Sourced
06:00 PM
DescriptionWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2010-4520?
CVE-2010-4520 has been rated as a security vulnerability that allows for cross-site scripting (XSS) attacks.
2
How do I fix CVE-2010-4520?
To fix CVE-2010-4520, update the Views module to version 6.x-2.11 or later.
3
Who is affected by CVE-2010-4520?
Users of the Views module for Drupal versions 6.x before 6.x-2.11 are affected by CVE-2010-4520.
4
What types of vulnerabilities are identified in CVE-2010-4520?
CVE-2010-4520 identifies multiple cross-site scripting (XSS) vulnerabilities.
5
Can CVE-2010-4520 be exploited remotely?
Yes, CVE-2010-4520 can be exploited remotely by attackers to inject arbitrary web scripts or HTML.