CVE-2010-2158 - CVE House
Back to Database
Status published Low CVE-2010-2158

Multiple cross-site scripting (XSS) vulnerabilities in the Storm module 5.x...

Vulnerability Description

Multiple cross-site scripting (XSS) vulnerabilities in the Storm module 5.x and 6.x before 6.x-1.33 for Drupal allow remote authenticated users, with certain module privileges, to inject arbitrary web script or HTML via the (1) fullname, (2) phone, or (3) im parameter in a stormperson action to index.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2010-2158

Credits & Attribution

No credits recorded in the NVD database.

References

More from speedtech

View All →
CVE-2010-2123
Multiple cross-site scripting (XSS) vulnerabilities in the Storm module 5.x...
Low 2.1
CVE-2009-4515
The Storm module 6.x before 6.x-1.25 for Drupal does not...
Medium 5
CVE-2007-4738
Multiple PHP remote file inclusion vulnerabilities in SpeedTech PHP Library...
High 7.5
CVE-2007-4737
Multiple PHP remote file inclusion vulnerabilities in SpeedTech PHP Library...
High 7.5

Affected Vendor

Affected Software

storm
Vulnerable Versions:
5.x-1.1, 5.x-1.2, 5.x-1.3, 5.x-1.4, 5.x-1.5, 5.x-1.6, 5.x-1.7, 5.x-1.8, 5.x-1.9, 5.x-1.10, 5.x-1.11, 5.x-1.12, 5.x-1.13, 5.x-1.14, 5.x-1.x, 6.x-1.0, 6.x-1.1, 6.x-1.2, 6.x-1.3, 6.x-1.4, 6.x-1.5, 6.x-1.6, 6.x-1.7, 6.x-1.8, 6.x-1.9, 6.x-1.10, 6.x-1.11, 6.x-1.12, 6.x-1.13, 6.x-1.14, 6.x-1.15, 6.x-1.16, 6.x-1.17, 6.x-1.18, 6.x-1.19, 6.x-1.20, 6.x-1.21, 6.x-1.22, 6.x-1.23, 6.x-1.24, 6.x-1.25, 6.x-1.26, 6.x-1.27, 6.x-1.28, 6.x-1.29, 6.x-1.30, 6.x-1.31, 6.x-1.32, 6.x-1.x

Timeline

Official Publish: June 7th, 2010
Last Modified: September 16th, 2024
Added to House: July 19th, 2026

CVSS Vectors

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.