CVE-2010-2473: Drupal

Medium severity, CVSS 6.5. EPSS: 1% chance of exploitation in the next 30 days.

Drupal 6.x before 6.16 and 5.x before version 5.22 does not properly block users under certain circumstances. A user with an open session that was blocked could maintain their session on the Drupal site despite being blocked.

Affected products

• Drupal Drupal: from 5.0, before 5.22 (fixed in 5.22); from 6.0, before 6.16 (fixed in 6.16)

Published 2019-11-07. Last modified 2026-06-16.