* Advisory ID: DRUPAL-SA-CONTRIB-2009-057 * Project: Date (third-party module) * Version: 5.x, 6.x * Date: 2009-September-16 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting
-------- DESCRIPTION ---------------------------------------------------------
The Date module provides a date CCK field that can be added to any content type. The Date module does not properly escape user data correctly in some cases when setting the page title. A malicious user with permission to post date content could attempt a cross site scripting [1] (XSS) attack when creating or editing content, leading to the user gaining full administrative access. -------- VERSIONS AFFECTED ---------------------------------------------------
* Date for Drupal 6.x prior to 6.x-2.4 * Date for Drupal 6.x prior to 5.x-2.8
Drupal core is not affected. If you do not use the contributed Date module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------
Upgrade to the latest version: * If you use Date for Drupal 6.x upgrade to Date 6.x-2.4 [2] * If you use Date for Drupal 5.x upgrade to Date 5.x-2.8 [3]
See also the Date project page [4]. -------- REPORTED BY ---------------------------------------------------------
The Acquia, Inc. support team -------- FIXED BY ------------------------------------------------------------
Karen Stevenson [5], the project maintainer. -------- CONTACT -------------------------------------------------------------
The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact.
[1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/579000 [3] http://drupal.org/node/578998 [4] http://drupal.org/project/date [5] http://drupal.org/user/45874