CVE-2010-1539
Estado: ModificadaBaja (2.1)—
Cross-site scripting (XSS) vulnerability in the Workflow module 5.x-2.x before 5.x-2.6 and 6.x-1.x before 6.x-1.4 for Drupal, when used with the Token module, might allow remote authenticated users to inject arbitrary web script or HTML via a certain Comment field.
CVSS
- Versión: 2.0
- Vector: AV:N/AC:H/Au:S/C:N/I:P/A:N
- Puntuación base: 2.1
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.99%
- Percentil entre todas las CVEs puntuadas: 61
- Fecha de la puntuación: 3/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-79
Referencias
- http://drupal.org/node/731624
- http://drupal.org/node/731644
- http://drupal.org/node/731648
- http://secunia.com/advisories/38825
- http://www.securityfocus.com/bid/38520
- https://exchange.xforce.ibmcloud.com/vulnerabilities/56638
- http://drupal.org/node/731624
- http://drupal.org/node/731644
- http://drupal.org/node/731648
- http://secunia.com/advisories/38825
- http://www.securityfocus.com/bid/38520
- https://exchange.xforce.ibmcloud.com/vulnerabilities/56638
JSON original (NVD)
Mostrar
{
"id": "CVE-2010-1539",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 2.1,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:H/Au:S/C:N/I:P/A:N",
"authentication": "SINGLE",
"integrityImpact": "PARTIAL",
"accessComplexity": "HIGH",
"availabilityImpact": "NONE",
"confidentialityImpact": "NONE"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "LOW",
"obtainAllPrivilege": false,
"exploitabilityScore": 3.9,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2010-04-26T19:30:00.597",
"references": [
{
"url": "http://drupal.org/node/731624",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://drupal.org/node/731644",
"tags": [
"Patch"
],
"source": "cve@mitre.org"
},
{
"url": "http://drupal.org/node/731648",
"tags": [
"Patch"
],
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/38825",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/38520",
"tags": [
"Patch"
],
"source": "cve@mitre.org"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56638",
"source": "cve@mitre.org"
},
{
"url": "http://drupal.org/node/731624",
"tags": [
"Patch",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://drupal.org/node/731644",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://drupal.org/node/731648",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/38825",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/38520",
"tags": [
"Patch"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/56638",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in the Workflow module 5.x-2.x before 5.x-2.6 and 6.x-1.x before 6.x-1.4 for Drupal, when used with the Token module, might allow remote authenticated users to inject arbitrary web script or HTML via a certain Comment field."
},
{
"lang": "es",
"value": "Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en el módulo Workflow 5.x-2.x en versiones anteriores a la 5.x-2.6 y 6.x-1.x en versiones anteriores a la 6.x-1.4 para Drupal, cuando se usa con el módulo Token, puede permitir a atacantes remotos autenticados inyectar secuencias de comandos web o HTML de su elección a través de un campo \"Comment\" determinado."
}
],
"lastModified": "2026-06-16T23:18:34.863",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:john_vandyk:workflow:5.x-2.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CFCD73E7-AF32-4D65-ADAB-C38A296F75FB"
},
{
"criteria": "cpe:2.3:a:john_vandyk:workflow:5.x-2.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F3A0CCFC-92B9-48B2-9205-4C3FCD76E5C9"
},
{
"criteria": "cpe:2.3:a:john_vandyk:workflow:5.x-2.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9493361F-1EEC-44A7-98B9-C5C3384C202F"
},
{
"criteria": "cpe:2.3:a:john_vandyk:workflow:5.x-2.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CBE717B5-ED74-4AE7-B5DD-B60FC48AAC47"
},
{
"criteria": "cpe:2.3:a:john_vandyk:workflow:5.x-2.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B4D7D66A-3828-44CB-A38E-5052910A8588"
},
{
"criteria": "cpe:2.3:a:john_vandyk:workflow:5.x-2.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A0F72183-AEB6-4EA6-9473-060055C0B5EC"
},
{
"criteria": "cpe:2.3:a:john_vandyk:workflow:5.x-2.x:dev:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "FFB1B349-52A8-46A1-AA9C-A018974661BF"
},
{
"criteria": "cpe:2.3:a:john_vandyk:workflow:6.x-1.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4831A82E-216B-40B6-BB69-251CBF6475F4"
},
{
"criteria": "cpe:2.3:a:john_vandyk:workflow:6.x-1.0:beta1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DAA18565-79DB-493A-981C-65E9E5A89740"
},
{
"criteria": "cpe:2.3:a:john_vandyk:workflow:6.x-1.0:beta2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "98FF3925-2D03-4E54-9596-5BDA6E807910"
},
{
"criteria": "cpe:2.3:a:john_vandyk:workflow:6.x-1.0:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "66428E92-396C-435E-907C-CB44A7D49258"
},
{
"criteria": "cpe:2.3:a:john_vandyk:workflow:6.x-1.0:rc3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D458714A-FD4A-4C89-ADF8-9A003749993C"
},
{
"criteria": "cpe:2.3:a:john_vandyk:workflow:6.x-1.0:rc4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "F93D053C-052C-402A-9DED-3BA81AF34053"
},
{
"criteria": "cpe:2.3:a:john_vandyk:workflow:6.x-1.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "79FAA734-2CE6-4BC8-9A66-3A279F151658"
},
{
"criteria": "cpe:2.3:a:john_vandyk:workflow:6.x-1.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1F1FA8BA-4393-4451-BD0C-BDDA08728BEA"
},
{
"criteria": "cpe:2.3:a:john_vandyk:workflow:6.x-1.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "162714F2-C953-48CE-9B65-67EEC3FE85EB"
},
{
"criteria": "cpe:2.3:a:john_vandyk:workflow:6.x-1.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "6961C5A3-BB6E-4A1A-A777-AE20AAB0879E"
},
{
"criteria": "cpe:2.3:a:john_vandyk:workflow:6.x-1.x-dev:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "352CD782-FB9C-4EC7-B99B-BF4E1063CFAD"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "799CA80B-F3FA-4183-A791-2071A7DA1E54"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "cve@mitre.org"
}