Storm CVE-2010-2158 Cross-Site Scripting Vulnerability
BID:73620
Info
Storm CVE-2010-2158 Cross-Site Scripting Vulnerability
| Bugtraq ID: | 73620 |
| Class: | Input Validation Error |
| CVE: |
CVE-2010-2158 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 07 2010 12:00AM |
| Updated: | Jun 07 2010 12:00AM |
| Credit: | Unknown |
| Vulnerable: |
SpeedTech Storm 6.X-1.X Dev SpeedTech Storm 6.X-1.9 SpeedTech Storm 6.X-1.8 SpeedTech Storm 6.x-1.7 SpeedTech Storm 6.x-1.6 SpeedTech Storm 6.x-1.5 SpeedTech Storm 6.x-1.4 SpeedTech Storm 6.X-1.32 SpeedTech Storm 6.X-1.31 SpeedTech Storm 6.X-1.30 SpeedTech Storm 6.x-1.3 SpeedTech Storm 6.X-1.29 SpeedTech Storm 6.X-1.28 SpeedTech Storm 6.X-1.27 SpeedTech Storm 6.X-1.26 SpeedTech Storm 6.X-1.25 SpeedTech Storm 6.X-1.24 SpeedTech Storm 6.X-1.23 SpeedTech Storm 6.X-1.22 SpeedTech Storm 6.X-1.21 SpeedTech Storm 6.X-1.20 SpeedTech Storm 6.X-1.2 SpeedTech Storm 6.X-1.19 SpeedTech Storm 6.X-1.18 SpeedTech Storm 6.X-1.17 SpeedTech Storm 6.X-1.16 SpeedTech Storm 6.X-1.15 SpeedTech Storm 6.X-1.14 SpeedTech Storm 6.X-1.13 SpeedTech Storm 6.x-1.12 SpeedTech Storm 6.X-1.11 SpeedTech Storm 6.x-1.10 SpeedTech Storm 6.x-1.1 SpeedTech Storm 6.X-1.0 SpeedTech Storm 5.X-1.X Dev SpeedTech Storm 5.X-1.9 SpeedTech Storm 5.X-1.8 SpeedTech Storm 5.X-1.7 SpeedTech Storm 5.x-1.6 SpeedTech Storm 5.x-1.5 SpeedTech Storm 5.x-1.4 SpeedTech Storm 5.X-1.3 SpeedTech Storm 5.X-1.2 SpeedTech Storm 5.X-1.14 SpeedTech Storm 5.X-1.13 SpeedTech Storm 5.X-1.12 SpeedTech Storm 5.x-1.11 SpeedTech Storm 5.X-1.10 SpeedTech Storm 5.X-1.1 |
| Not Vulnerable: | |
Discussion
Storm CVE-2010-2158 Cross-Site Scripting Vulnerability
Storm is prone to a cross-site scripting vulnerability. Multiple cross-site scripting (XSS) vulnerabilities in the Storm module 5.x and 6.x before 6.x-1.33 for Drupal allow remote authenticated users, with certain module privileges, to inject arbitrary web script or HTML via the (1) fullname, (2) phone, or (3) im parameter in a stormperson action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Storm is prone to a cross-site scripting vulnerability. Multiple cross-site scripting (XSS) vulnerabilities in the Storm module 5.x and 6.x before 6.x-1.33 for Drupal allow remote authenticated users, with certain module privileges, to inject arbitrary web script or HTML via the (1) fullname, (2) phone, or (3) im parameter in a stormperson action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Exploit / POC
Storm CVE-2010-2158 Cross-Site Scripting Vulnerability
An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.
Solution / Fix
Storm CVE-2010-2158 Cross-Site Scripting Vulnerability
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or you are aware of more recent information, please mail us at: [email protected]
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or you are aware of more recent information, please mail us at: [email protected]
References
Storm CVE-2010-2158 Cross-Site Scripting Vulnerability
References:
References: