Security-news August 2010

security-news@drupal.org

1 participants
12 discussions

SA-CONTRIB-2010-080 - Privatemsg - Cross Site Scripting
by security-news＠drupal.org 11 Aug '10

11 Aug '10

* Advisory ID: DRUPAL-SA-CONTRIB-2010-080 * Project: Privatemsg (third-party module) * Version: 6.x * Date: 2010-August-11 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Cross-Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Privatemsg module allows to send private messages between users. The module does not properly escape user-supplied data before displaying it, leading to a Cross Site Scripting (XSS [1]) vulnerability. Any user with permission to write private messages is vulnerable to attack. -------- VERSIONS AFFECTED --------------------------------------------------- * Privatemsg module for Drupal 6.x versions prior to 6.x-1.3 Drupal core is not affected. If you do not use the contributed Privatemsg [2] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Privatemsg module for Drupal 6.x upgrade to Privatemsg 6.x-1.3 [3] See also the Privatemsg project page [4]. -------- REPORTED BY --------------------------------------------------------- * Ben Durbin (bdurbin) [5] -------- FIXED BY ------------------------------------------------------------ * Ben Durbin (bdurbin) [6] * Sascha Grossenbacher (Berdir) [7], module maintainer -------- CONTACT ------------------------------------------------------------- The Drupal security team [8] can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/project/privatemsg [3] http://drupal.org/node/880036 [4] http://drupal.org/project/privatemsg [5] http://drupal.org/user/165644 [6] http://drupal.org/user/165644 [7] http://drupal.org/user/214652 [8] http://drupal.org/security-team

1 0

SA-CONTRIB-2010-079 - Devel (Performance logging) - Cross Site Scripting
by security-news＠drupal.org 04 Aug '10

04 Aug '10

* Advisory ID: SA-CONTRIB-2010-079 * Project: Devel (third-party module) * Version: 5.x, 6.x * Date: 2010-Aug-04 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION: -------------------------------------------------------- The devel project is a suite of modules for developers and themers. Within the devel project, there is the performance logging module. The module does not escape URLs comprised of node paths, leading to a Cross Site Scripting (XSS) vulnerability. Users with the permission to access the reports that the performance module produces are vulnerable to attack. A malicious user needs the ability to add url aliases to create and exploit the vulnerability. -------- VERSIONS AFFECTED: -------------------------------------------------- * Devel module for Drupal 5.x versions prior to 5.x-1.3 * Devel module for Drupal 6.x versions prior to 6.x-1.21 Drupal core is not affected. If you do not use the contributed performance logging module, there is nothing you need to do. -------- SOLUTION: ----------------------------------------------------------- Install the latest version: * For Drupal 5.x, upgrade to Devel 5.x-1.3 [1] * For Drupal 6.x, upgrade to Devel 6.x-1.21 [2] See also the Devel [3] project page. -------- REPORTED BY: -------------------------------------------------------- * Justin James Grevich -------- FIXED BY: ----------------------------------------------------------- * Khalid Baheyeldin (kbahey [4]), the performance logging module maintainer The Drupal security team can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/node/874130 [2] http://drupal.org/node/874116 [3] http://drupal.org/project/devel [4] http://drupal.org/user/4063

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news August 2010