CVE-2010-1584

Severity: low (CVSS 2.1 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2010-05-19 · updated 2026-06-16
Weakness: CWE-79

Description

Cross-site scripting (XSS) vulnerability in the Context module before 6.x-2.0-rc4 for Drupal allows remote authenticated users, with Administer Blocks privileges, to inject arbitrary web script or HTML via a block description.

Affected products

Steven Jones Context: through 6.x-2.0; 6.x-2.0-alpha1, 6.x-2.0-alpha2, 6.x-2.0-beta1, 6.x-2.0-beta2, 6.x-2.0-beta3, 6.x-2.0-beta4 (+5)

References

http://crackingdrupal.com/blog/greggles/mitigation-against-cve-2010-1584-drupal-context-module-xss
http://drupal.org/cvs?commit=365210
http://drupal.org/node/794718
http://drupal.org/node/795118
http://www.madirish.net/?article=457
http://www.packetstormsecurity.com/1005-exploits/drupalab-xss.txt
http://www.securityfocus.com/bid/40056
http://www.theregister.co.uk/2010/05/10/drupal_security_bug/
https://exchange.xforce.ibmcloud.com/vulnerabilities/58521
http://crackingdrupal.com/blog/greggles/mitigation-against-cve-2010-1584-drupal-context-module-xss
http://drupal.org/cvs?commit=365210
http://drupal.org/node/794718

Get alerted when CVE-2010-1584 or the next vulnerability affects your stack