CVE-2010-0370
3.5
Vector
AV:N/AC:M/Au:S/C:N/I:P/A:N
Exploitability: 6.8 / Impact: 2.9
Source: NVD
Description
Cross-site scripting (XSS) vulnerability in the Node Blocks module 5.x-1.1 and earlier, and 6.x-1.3 and earlier, a module for Drupal, allows remote authenticated users, with permissions to create or edit content and administer blocks, to inject arbitrary web script or HTML via the edit-title parameter (aka block title).
Affected (6)
Products: Roger Lopez: Nodeblock · Thomas Turnbull: Nodeblock
Configuration A
| Vulnerable Software | Affected Versions |
|---|---|
| Up to 5.x-1.1 | |
| Up to 6.x-1.3 |
| Running on/with | Platform Versions |
|---|---|
Drupal Drupal | All versions |
References (18)
Source: cve@mitre.org
Source: cve@mitre.org
Source: af854a3a-2127-422b-91ae-364da2661108
Exploit
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Timeline
No history available yet.