Security readout for executives and security teams
Plain-English summary
Older PmWiki installations before 2.2.21 are reported vulnerable to cross-site scripting. In business terms, a vulnerable public wiki could let attacker-supplied script run in a user’s browser, potentially affecting trust, sessions, or content integrity. The public record gives very little detail beyond the version boundary.
Executive priority
Prioritize as an exposure cleanup item, with urgency increasing for public or business-critical wikis. The absence of CVSS and exploitation evidence limits confidence, but unsupported legacy wiki software remains a practical risk.
Technical view
CVE-2010-4662 describes an XSS issue in PmWiki versions before 2.2.21. The available bundle does not include CVSS, CWE, affected paths, prerequisites, or a detailed root cause. Treat the version threshold as the primary exposure indicator.
Likely exposure
Exposure is most likely where an organization still runs PmWiki older than 2.2.21, especially if the wiki is internet-facing or reachable by many users. The sources do not identify specific configurations, plugins, or pages beyond PmWiki version.
Exploitation context
The bundle does not show CISA KEV listing or cited evidence of active exploitation. Public references exist, but the provided sources do not establish exploit maturity, affected endpoint details, or exploitation in the wild.
Researcher notes
The source bundle is sparse: it confirms product, version boundary, and XSS classification only. Do not assume a specific sink, vector, authentication requirement, or payload behavior without consulting the referenced advisories or vendor history.
Mitigation direction
- Inventory all PmWiki deployments and record their exact versions.
- Upgrade PmWiki installations before 2.2.21 to 2.2.21 or later.
- Check current vendor guidance for any additional hardening or backport instructions.
- Limit public access to legacy PmWiki instances until version status is confirmed.
Validation and detection
- Confirm the running PmWiki version from application files or administrative metadata.
- Map whether each PmWiki instance is internet-facing, internal-only, or decommissioned.
- Review web logs for unusual script-like input around wiki requests.
- Verify remediation by confirming the deployed version is not before 2.2.21.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2010-4662 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://packetstormsecurity.com/files/cve/CVE-2010-4662CVE reference · x_refsource_MISC
- https://www.openwall.com/lists/oss-security/2011/02/23/23CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.