Security-news

security-news@drupal.org

1 participants
1782 discussions

SA-CONTRIB-2012-041 - Fancy Slide - Cross Site Scripting (XSS)
by security-news＠drupal.org 14 Mar '12

14 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-041 * Project: Fancy Slide [1] (third-party module) * Version: 6.x * Date: 2012-March-14 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module enables you to create slideshow blocks to embed into templates. The module doesn't sufficiently filter user supplied text. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer fancy_slide". -------- VERSIONS AFFECTED --------------------------------------------------- * Fancy Slide 6.x-2.x versions prior to 6.x-2.6. Drupal core is not affected. If you do not use the contributed Fancy Slide [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Fancy Slide module for Drupal 6.x, upgrade to Fancy Slide 6.x-2.7 [4] See also the Fancy Slide [5] project page. -------- REPORTED BY --------------------------------------------------------- * Justine Klein Keane [6] -------- FIXED BY ------------------------------------------------------------ * Justine Klein Keane [7] * Paul Lomax [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Stella Power [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/fancy_slide [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/fancy_slide [4] http://drupal.org/node/1417688 [5] http://drupal.org/project/fancy_slide [6] http://drupal.org/user/302225 [7] http://drupal.org/user/302225 [8] http://drupal.org/user/253872 [9] http://drupal.org/user/66894 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-040 - CKEditor and FCKeditor - multiple XSS, arbitrary code execution
by security-news＠drupal.org 14 Mar '12

14 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-040 * Project: CKEditor [1], FCKeditor [2] - WYSIWYG HTML editor (third-party module) * Version: 6.x, 7.x * Date: 2012-March-14 * Security risk: Highly critical [3] * Exploitable from: Remote * Vulnerability: Cross Site Scripting, Cross Site Request Forgery, Arbitrary PHP code execution -------- DESCRIPTION --------------------------------------------------------- CKEditor and its predecessor FCKeditor allow Drupal to replace textarea fields with the (F)CKEditor - a visual HTML WYSIWYG editor. The modules have an AJAX callback that filters text to prevent Cross site scripting attacks on content edits. This AJAX callback function contains a number of bugs which allow attackers to chose which filter to execute on chosen text or bypass the filter entirely. The vulnerability can be used to conduct Cross site scripting (XSS) attacks on privileged users. Attackers can also execute arbitrary PHP code if the core PHP module is enabled. This can happen either directly or by enticing a privileged user to visit a page. Direct execution of PHP code requires that the attacker has the following privileges: "access fckeditor" for FCKeditor 6.x "access ckeditor" for CKEditor 6.x No additional permissions are required to directly exploit the PHP code execution flaw on CKEditor 7.x. -------- VERSIONS AFFECTED --------------------------------------------------- * FCKeditor 6.x-2.x versions prior to 6.x-2.3. * CKEditor 6.x-1.x versions prior to 6.x-1.9. * CKEditor 7.x-1.x versions prior to 7.x-1.7. Drupal core is not affected. If you do not use the contributed CKEditor - WYSIWYG HTML editor [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the FCKeditor module for Drupal 6.x, upgrade to FCKeditor 6.x-2.3 [5]. * If you use the CKEditor module for Drupal 6.x, upgrade to CKEditor 6.x-1.9 [6]. * If you use the CKEditor module for Drupal 7.x, upgrade to CKEditor 7.x-1.7 [7]. See also the CKEditor - WYSIWYG HTML editor [8] project page. -------- REPORTED BY --------------------------------------------------------- * Heine Deelstra [9] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Wiktor Walc [10] the module maintainer -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/ckeditor [2] http://drupal.org/project/fckeditor [3] http://drupal.org/security-team/risk-levels [4] http://drupal.org/project/ckeditor [5] http://drupal.org/node/1482442 [6] http://drupal.org/node/1482480 [7] http://drupal.org/node/1482466 [8] http://drupal.org/project/ckeditor [9] http://drupal.org/user/17943 [10] http://drupal.org/user/184556 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-039 - Language Icons - Cross Site Scripting (XSS)
by security-news＠drupal.org 14 Mar '12

14 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-039 * Project: Language icons [1] (third-party module) * Version: 6.x, 7.x * Date: 2012-March-14 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Language icons module adds icons to language links generated by the Locale and Content Translation modules in core. The module does not sanitize some of the user-supplied data before displaying it, leading to a Cross Site Scripting (XSS [3]) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer languages". -------- VERSIONS AFFECTED --------------------------------------------------- * Language icons 6.x-2.x versions prior to 6.x-2.1. * Language icons 7.x-1.x versions prior to 7.x-1.0. Drupal core is not affected. If you do not use the contributed Language icons [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Language icons module for Drupal 6.x, upgrade to Language icons 6.x-2.1 [5] * If you use the Language icons module for Drupal 7.x, upgrade to Language icons 7.x-1.0 [6] See also the Language icons [7] project page. -------- REPORTED BY --------------------------------------------------------- * Jose Reyero [8] the original module author * Frederik "Freso" S. Olesen [9] the current module maintainer -------- FIXED BY ------------------------------------------------------------ * Frederik "Freso" S. Olesen [10] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. [1] http://drupal.org/project/languageicons [2] http://drupal.org/security-team/risk-levels [3] http://en.wikipedia.org/wiki/Cross-site_scripting [4] http://drupal.org/project/languageicons [5] http://drupal.org/node/1482144 [6] http://drupal.org/node/1482136 [7] http://drupal.org/project/languageicons [8] http://drupal.org/user/4299 [9] http://drupal.org/user/27504 [10] http://drupal.org/user/27504 [11] http://drupal.org/user/36762 [12] http://drupal.org/contact [13] http://drupal.org/security-team [14] http://drupal.org/writing-secure-code [15] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-038 - Views Language Switcher Cross Site Scripting (XSS)
by security-news＠drupal.org 14 Mar '12

14 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-038 * Project: Views Language Switcher [1] (third-party module) * Version: 7.x * Date: 2012-March-14 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Views Language Switcher module enables you to provide natively-formatted links that act as Views exposed filters for i18n content being displayed by Views. The module doesn't sufficiently filter the path output when a user manually modifies the path and makes a new request. This vulnerability can be exploited by anonymous users. -------- VERSIONS AFFECTED --------------------------------------------------- * Views Language Switcher 7.x-1.x versions prior to 7.x-1.2. Drupal core is not affected. If you do not use the contributed Views Language Switcher [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Views Language Switcher module for Drupal 7.x, upgrade to Views Language Switcher 7.x-1.2 [4] See also the Views Language Switcher [5] project page. -------- REPORTED BY --------------------------------------------------------- * Chris Ruppel [6] -------- FIXED BY ------------------------------------------------------------ * Chris Ruppel [7] the module maintainer * Greg Knaddison [8] of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/views_lang_switch [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/views_lang_switch [4] http://drupal.org/node/1482268 [5] http://drupal.org/project/views_lang_switch [6] http://drupal.org/user/411999 [7] http://drupal.org/user/411999 [8] http://drupal.org/user/36762 [9] http://drupal.org/user/36762 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-037 - Slidebox - access bypass
by security-news＠drupal.org 14 Mar '12

14 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-037 * Project: Slidebox [1] (third-party module) * Version: 7.x * Date: 2012-March-14 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- The Slidebox [3] module allows webmasters do display a link to the next node in a jQuery box that slides in from the right side of the page after a user scrolls past a certain point. While the module checks for "published" status, the module does not contain sufficient usage of node_access() to prevent users from accessing content that they do not have proper permission to access (for example, nodes or node types that have been protected via an access control module). -------- VERSIONS AFFECTED --------------------------------------------------- * Slidebox 7.x-1.x versions prior to and including 7.x-1.3. * Slidebox 7.x-2.x-dev Drupal core is not affected. If you do not use the contributed Slidebox [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Slidebox module for Drupal 7.x, upgrade to Slidebox 7.x-1.4 [5] See also the Slidebox [6] project page. -------- REPORTED BY --------------------------------------------------------- * Joshua Brauer [7] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Brian Altenhofel [8] - the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [9] of the Drupal Security Team * Dave Reid [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/slidebox [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/slidebox [4] http://drupal.org/project/slidebox [5] http://drupal.org/node/1482166 [6] http://drupal.org/project/slidebox [7] http://drupal.org/user/12363 [8] http://drupal.org/user/550616 [9] http://drupal.org/user/102818 [10] http://drupal.org/user/53892 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-036 - Multiple Modules Unsupported
by security-news＠drupal.org 14 Mar '12

14 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-036 * Projects: Content Lock [1], Ubercart Bulk Stock Updater [2], Ubercart Payflow Link [3], ticketyboo News Ticker [4], Admin tools [5], Redirecting click bouncer [6] (third-party modules) * Version: 6.x * Version: 7.x * Date: 2012-March-14 * Security risk: Critical [7] * Exploitable from: Remote * Vulnerability: Information Disclosure -------- DESCRIPTION --------------------------------------------------------- Content Lock [8] Is a module that prevents users from concurrent editing of nodes. This module does not use a token for unlocking a content lock. This leads to a CSRF attack vector. Ubercart Bulk Stock Updater [9] is an extension module for Ubercart 2.x running on Drupal 6.x which makes it easy to bulk-edit product stock levels. This module does not properly use the formAPI and this results in a CSRF attack vector. Ubercart Payflow Link [10] is a payment solution for ubercart provided by PayPal. This module does not use a secure token and thus could allow payments to be forged. ticketyboo News Ticker [11]is a module that lets you configure three separate news tickers as Drupal Blocks. This module does not filter output correctly leading to a XSS attack vector. It may also have a SQL injection vector. Admin tools [12] This package will contain a complete set of tools for managing several drupal installs. This module does not properly filter text leading to a XSS attack vector, as well as not checking tokens leading to a CSRF attack vector. Redirecting click bouncer [13], is a module that lets you create links to a target that simply redirects to the real destination. The redirect happens server-side which means that we can track the redirects. This comes handy when we have links in our site and we need to know when they are clicked. This module does not check the URL to redirect to, this create an open redirect. -------- VERSIONS AFFECTED --------------------------------------------------- * All versions of Content Lock are affected by vulnerabilities. * All versions of Ubercart Bulk Stock Updater payment are affected by vulnerabilities. * All versions of Ubercart Payflow Link are affected by vulnerabilities. * All versions of ticketyboo News Ticker are affected by vulnerabilities. * All versions of Admin tools are affected by vulnerabilities. * All versions of Redirecting click bouncer are affected by vulnerabilities. * All versions of Printer, e-mail and PDF versions are affected by vulnerabilities. Drupal core is not affected. If you do not use one of the contributed modules listed above, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Users of these modules are encouraged to disable the modules and search for similar alternatives. Users of the module who wish to take over maintainership should post patches to the issue queue to fix the security issues and request maintenance following the Unsupported project process [14]. -------- REPORTED BY --------------------------------------------------------- * Content Lock issue reported by Charlie Gordon [15] * Ubercart Bulk Stock Updater issue reported by Peter Boden [16] * Ubercart Payflow Link issue reported by Dylan Tack [17] of the Drupal Security Team * ticketyboo News Ticker issue reported by Sascha Grossenbacher [18] * Admintools issue reported by Ivo Van Geertruyen [19] of the Drupal Security Team * Redirecting click bouncer issue reported by John T. Haller -------- FIXED BY ------------------------------------------------------------ No fixes created. -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [20] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [21]. Learn more about the Drupal Security team and their policies [22], writing secure code for Drupal [23], and securing your site [24]. [1] http://drupal.org/project/content_lock [2] http://drupal.org/project/uc_bulk_stock_updater [3] http://drupal.org/project/uc_payflowlink [4] http://drupal.org/project/ticketyboo [5] http://drupal.org/project/admintools [6] http://drupal.org/project/bouncer [7] http://drupal.org/security-team/risk-levels [8] http://drupal.org/project/content_lock [9] http://drupal.org/project/uc_bulk_stock_updater [10] http://drupal.org/project/uc_payflowlink [11] http://drupal.org/project/ticketyboo [12] http://drupal.org/project/admintools [13] http://drupal.org/project/bouncer [14] http://drupal.org/node/251466 [15] http://drupal.org/user/157412 [16] http://drupal.org/user/55050 [17] http://drupal.org/user/96647 [18] http://drupal.org/user/214652 [19] http://drupal.org/user/383424 [20] http://drupal.org/user/102818 [21] http://drupal.org/contact [22] http://drupal.org/security-team [23] http://drupal.org/writing-secure-code [24] http://drupal.org/security/secure-configuration

1 0

DRUPAL-PSA-2012-001 - localizations - Cross Site Scripting
by security-news＠drupal.org 07 Mar '12

07 Mar '12

* Advisory ID: DRUPAL-PSA-2012-001 * Version: 6.x, 7.x * Date: 2012-March-07 * Security risk: Moderately critical [1] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This is a public service announcement regarding possible cross-site scripting risks associated with interface localizations for Drupal. Drupal has cross-site scripting prevention filters in the interface localization import code in Drupal core, however, the extent to which localization can be used to inject markup to webpages is wider, and due to Drupal's localization architecture and code reuse, we cannot tell in advance where the localized text is going to be used and how we should sanitize the translated text. When translated text is used, developers do not expect that it might cause cross-site scripting issues and therefore do not use filtering techniques when the resulting text is assembled into the output. You should be aware that Drupal's cross-site scripting prevention for interface localizations is not complete and therefore you should review the localizations imported to your site before importing them or ensure that they come from trusted sources. Even Drupal's central localization source, localize.drupal.org has configurable permission system for teams. Those teams where translations are moderated by a team of volunteers are less likely to contain any attack code. Consequently we are adding /translate interface/ to our list of advanced permissions in our Security advisories process and permissions policy [2] document. The issue also affect contributed modules like Localization update which automate localization import from localize.drupal.org and compatible servers or String overrides, which allows you to use the localization system to override English built-in text. -------- VERSIONS AFFECTED --------------------------------------------------- Multiple modules can be used to translate the interface text. Some of those are * Locale module in Drupal core. * Localization update [3] * String overrides [4] Drupal core is not affected. If you do not use the contributed module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Given that translations strings can be harmful, you should treat them with the same skepticism that you treat modules. Get them from reputable sources or review them prior to using them. See also the project page. -------- REPORTED BY --------------------------------------------------------- * The underlying issue was reported by Justin C. Klein Keane [5] -------- FIXED BY ------------------------------------------------------------ This PSA drafted by: * Gábor Hojtsy [6] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [7]. Learn more about the Drupal Security team and their policies [8], writing secure code for Drupal [9], and securing your site [10]. [1] http://drupal.org/security-team/risk-levels [2] http://drupal.org/security-advisory-policy [3] http://drupal.org/project/l10n_update [4] http://drupal.org/project/stringoverrides [5] http://drupal.org/user/302225 [6] http://drupal.org/user/4166 [7] http://drupal.org/contact [8] http://drupal.org/security-team [9] http://drupal.org/writing-secure-code [10] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-035 - Webform Cross Site Scripting (XSS)
by security-news＠drupal.org 07 Mar '12

07 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-035 * Project: Webform [1] (third-party module) * Version: 6.x, 7.x * Date: 2012-March-07 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Webform module allows content creators to assemble a survey for end-users. The module doesn't sufficiently filter user supplied text when displaying radio buttons or checkboxes when used in combination with the Select or Other... [3] module. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "create webform content" and the Select or Other... module must be installed on the site. -------- VERSIONS AFFECTED --------------------------------------------------- * Webform 6.x-3.x versions prior to 6.x-1.17. * Webform 7.x-3.x versions prior to 7.x-1.17. Drupal core is not affected. If you do not use the contributed Webform [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Webform module for Drupal 6.x, upgrade to Webform 6.x-1.17 [5] * If you use the Webform module for Drupal 7.x, upgrade to Webform 7.x-1.17 [6] If you do not use Select or Other... module, no action is necessary. See also the Webform [7] project page. -------- REPORTED BY --------------------------------------------------------- * Kyle Small [8] -------- FIXED BY ------------------------------------------------------------ * Nate Haug [9] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [10] of the Drupal Security Team * John Morahan [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. [1] http://drupal.org/project/webform [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/select_or_other [4] http://drupal.org/project/webform [5] http://drupal.org/node/1472178 [6] http://drupal.org/node/1472180 [7] http://drupal.org/project/webform [8] http://drupal.org/user/832278 [9] http://drupal.org/user/35821 [10] http://drupal.org/user/36762 [11] http://drupal.org/user/58170 [12] http://drupal.org/contact [13] http://drupal.org/security-team [14] http://drupal.org/writing-secure-code [15] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-034 - Node Recommendation Cross Site Scripting (XSS)
by security-news＠drupal.org 07 Mar '12

07 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-034 * Project: Node Recommendation [1] (third-party module) * Version: 6.x * Date: 2012-March-7 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module shows users other nodes that they might be interested in based on a simple logic and using taxonomy. The aim of this module is to provide sensible defaults and an easy configuration for less-technical users and to allow it to be manually overriden. The module doesn't sufficiently filter user supplied text. The vulnerability is mitigated by the fact that an attacker would need permission to create taxonomy terms or edit node titles to exploit the issue. -------- VERSIONS AFFECTED --------------------------------------------------- * Node recommendation 6.x-1.x versions prior to 6.x-1.1. Drupal core is not affected. If you do not use the contributed Node Recommendation [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Node recommendation module for Drupal 6.x, upgrade to Node recommendation 6.x-1.1 [4] See also the Node Recommendation [5] project page. -------- REPORTED BY --------------------------------------------------------- * Dylan Tack [6] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Ariel Barreiro [7] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [8] of the Drupal Security Team * Michael Hess [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/noderecommendation [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/noderecommendation [4] http://drupal.org/node/1471906 [5] http://drupal.org/project/noderecommendation [6] http://drupal.org/user/96647 [7] http://drupal.org/user/23157 [8] http://drupal.org/user/36762 [9] http://drupal.org/user/102818 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-033 - Read More Link - Cross Site Scripting
by security-news＠drupal.org 07 Mar '12

07 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-033 * Project: Read More Link [1] (third-party module) * Version: 6.x * Date: 2012-March-07 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Read More Link module allows you to move the "Read more" link from the node's links area to the end of the teaser text. A user could inject java script into pages affecting other site users. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access administration pages." -------- VERSIONS AFFECTED --------------------------------------------------- * Read More Link 6.x-3.x versions prior to and including 6.x-3.0. Drupal core is not affected. If you do not use the contributed Read More Link (Drupal 6 and earlier) [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Read More Link module for Drupal 6.x, upgrade to version 6.x-3.1 [4] or 6.x-5.0 [5] See also the Read More Link [6] project page. -------- REPORTED BY --------------------------------------------------------- * Kyle Small -------- FIXED BY ------------------------------------------------------------ * Stéphane Corlosquet [7] * Todd Nienkerk [8] -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/ed_readmore [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/ed_readmore [4] http://drupal.org/node/1471080 [5] http://drupal.org/node/1306640 [6] http://drupal.org/project/ed_readmore [7] http://drupal.org/user/52142 [8] http://drupal.org/user/92096 [9] http://drupal.org/user/102818 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news