LiveActive security incident?Get immediate response
CVE Record

CVE-2010-4245: pootle 2.0.5 has XSS via 'match_names' parameter

pootle 2.0.5 has XSS via 'match_names' parameter

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2010-4245 describes cross-site scripting in Pootle 2.0.5 through the match_names parameter. Affected systems may let an attacker inject script into a user's browser. The source bundle does not provide CVSS, confirmed impact scope, or a named fixed version.

Executive priority

Prioritize based on whether Pootle 2.0.5 exists and whether it is externally reachable. Public exposure should be handled promptly because XSS can affect user sessions, trust, and data integrity. If Pootle is absent, this CVE is not relevant to the environment.

Technical view

The CVE record states that Pootle 2.0.5 has XSS via match_names. No CWE, CVSS vector, vulnerable endpoint details, proof-of-concept status, or fixed release is included in the provided sources. Treat exposure as application-specific and verify against deployed Pootle versions and distribution advisories.

Likely exposure

Exposure is most likely where Pootle 2.0.5 is deployed and reachable by users, especially public or partner-facing translation portals. The provided affected data only names version 2.0.5 and does not identify CPEs or broader affected releases.

Exploitation context

The source bundle does not show CISA KEV listing or cited evidence of active exploitation. It only describes an XSS condition involving match_names. Do not assume exploitation in the wild without additional vendor, distro, or threat intelligence evidence.

Researcher notes

Evidence is sparse. The CVE text identifies Pootle 2.0.5 and match_names, but lacks endpoint detail, payload characteristics, fixed version, CVSS, and exploitation evidence. Use the referenced Debian and Red Hat records to determine package-specific status before concluding remediation state.

Mitigation direction

  • Inventory any Pootle deployments and confirm whether version 2.0.5 is present.
  • Check Debian, Red Hat, and upstream Pootle guidance for fixed packages or supported workarounds.
  • Apply the vendor or distribution update if your advisory channel identifies one.
  • Restrict access to affected Pootle instances until remediation is confirmed.
  • Retire unsupported Pootle deployments that cannot receive security updates.

Validation and detection

  • Confirm the running Pootle version from approved asset or package records.
  • Review web routes and logs for use of the match_names parameter.
  • Check whether the instance is internet-facing, authenticated-only, or internal-only.
  • Verify remediation by comparing installed packages against vendor or distro advisory guidance.
  • Use approved non-destructive XSS testing in staging or a controlled maintenance window.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2010-4245 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/a2.0.5Listed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.