CVE-2010-2048 Multiple cross-site scripting (XSS) vulnerabilities in the Heartbeat module 6.x before 6.x-4.9 for Drupal allow remote authenticated users to inject arbitrary web script or HTML via unspecified vector...
LowCVSS 3.5
EPSS 0.87%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Multiple cross-site scripting (XSS) vulnerabilities in the Heartbeat module 6.x before 6.x-4.9 for Drupal allow remote authenticated users to inject arbitrary web script or HTML via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| menhir heartbeat | = 6.x-2.3 | No fix listed |
| menhir heartbeat | = 6.x-2.3-beta1 | No fix listed |
| menhir heartbeat | = 6.x-2.3-beta2 | No fix listed |
| menhir heartbeat | = 6.x-3.2 | No fix listed |
| menhir heartbeat | = 6.x-3.3 | No fix listed |
| menhir heartbeat | = 6.x-3.x-dev | No fix listed |
| menhir heartbeat | = 6.x-4.0 | No fix listed |
| menhir heartbeat | = 6.x-4.1 | No fix listed |
| menhir heartbeat | = 6.x-4.2 | No fix listed |
| menhir heartbeat | = 6.x-4.3 | No fix listed |
| menhir heartbeat | = 6.x-4.3-beta1 | No fix listed |
| menhir heartbeat | = 6.x-4.3-beta2 | No fix listed |
| menhir heartbeat | = 6.x-4.3-beta3 | No fix listed |
| menhir heartbeat | = 6.x-4.4 | No fix listed |
| menhir heartbeat | = 6.x-4.5 | No fix listed |
| menhir heartbeat | = 6.x-4.6 | No fix listed |
| menhir heartbeat | = 6.x-4.7 | No fix listed |
| menhir heartbeat | = 6.x-4.8 | No fix listed |
| menhir heartbeat | = 6.x-4.x-dev | No fix listed |
References
- drupal.org patch
- drupal.org patch vendor-advisory
- 39893 third-party-advisory vendor-advisory
- 40268 patch vdb-entry
- heartbeat-unspecified-xss(58702) vdb-entry