* Advisory ID: DRUPAL-SA-CONTRIB-2011-007 * Project: Userpoints (third-party module) * Version: 6.x * Date: 2011-February-02 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting
-------- DESCRIPTION ---------------------------------------------------------
The Userpoints module allows users to gain points through specific actions like contributing content. The module does not sanitize some of the user-supplied data before displaying it, leading to a Cross Site Scripting (XSS [1]) vulnerability that may lead to a malicious user gaining full administrative access. This vulnerability is mitigated by the fact that the attacker must have a role with the "administer userpoints" permission.
-------- VERSIONS AFFECTED ---------------------------------------------------
* Userpoints module for Drupal 6.x versions prior to 6.x-1.2
Drupal core is not affected. If you do not use the contributed Userpoints [2] module, there is nothing you need to do.
-------- SOLUTION ------------------------------------------------------------
Install the latest version:
* If you use the Userpoints module for Drupal 6.x upgrade to Userpoints 6.x-1.2 [3]
See also the Userpoints project page [4].
-------- REPORTED BY ---------------------------------------------------------
* Sascha Grossenbacher (Berdir) [5], Userpoints module maintainer
-------- FIXED BY ------------------------------------------------------------
* Sascha Grossenbacher (Berdir) [6], Userpoints module maintainer
-------- CONTACT AND MORE INFORMATION ----------------------------------------
The Drupal security team can be reached at security at drupal.org [7] or via the form at http://drupal.org/contact [8]. Learn more about the team and their policies [9], writing secure code for Drupal [10], and secure configuration [11] of your site.
[1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/project/userpoints [3] http://drupal.org/node/1048946 [4] http://drupal.org/project/userpoints [5] http://drupal.org/user/214652 [6] http://drupal.org/user/214652 [7] http://drupal.org [8] http://drupal.org/contact [9] http://drupal.org/security-team [10] http://drupal.org/writing-secure-code [11] http://drupal.org/security/secure-configuration