CVE-2010-2472

Severity: medium (CVSS 4.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-11-07 · updated 2026-06-16
Weakness: CWE-79

Description

Locale module and dependent contributed modules in Drupal 6.x before 6.16 and 5.x before version 5.22 do not sanitize the display of language codes, native and English language names properly which could allow an attacker to perform a cross-site scripting (XSS) attack. This vulnerability is mitigated by the fact that an attacker must have a role with the 'administer languages' permission.

Affected products

Drupal: from 5.0 before 5.22; from 6.0 before 6.16 — fixed in 5.22, 6.16

How to fix

Upgrade to a fixed version: Drupal 5.22, 6.16. Check the vendor advisory for mitigations.

References

https://security-tracker.debian.org/tracker/CVE-2010-2472
https://www.drupal.org/node/731710
https://www.openwall.com/lists/oss-security/2010/06/28/8
https://security-tracker.debian.org/tracker/CVE-2010-2472
https://www.drupal.org/node/731710
https://www.openwall.com/lists/oss-security/2010/06/28/8

Get alerted when CVE-2010-2472 or the next vulnerability affects your stack