* Advisory ID: DRUPAL-SA-CONTRIB-2009-038 * Project: Nodequeue (third-party module) * Version: 5.x, 6.x * Date: 2009-June-10 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Multiple vulnerabilities -------- DESCRIPTION --------------------------------------------------------- The Nodequeue module enables an administrator to arbitrarily put nodes in a group for some purpose, such as providing a listing of nodes or featuring a particular node. It suffers from a cross-site scripting [1] (XSS) vulnerability due to not properly sanitizing vocabulary names before they are displayed. Additionally, the module does not respect node access restrictions when displaying node titles. -------- VERSIONS AFFECTED --------------------------------------------------- * Nodequeue for Drupal 5.x prior to Nodequeue 5.x-2.7 * Nodequeue for Drupal 6.x prior to Nodequeue 6.x-2.2 Drupal core is not affected. If you do not use the contributed Nodequeue module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Upgrade to the latest version: * If you use Nodequeue for Drupal 5.x upgrade to Nodequeue 5.x-2.7 [2] * If you use Nodequeue for Drupal 6.x upgrade to Nodequeue 6.x-2.2 [3] See also the Nodequeue project page [4]. -------- REPORTED BY --------------------------------------------------------- * The XSS issue was reported by Justin C. Klein Keane [5]. * The access bypass issue was reported by Ezra Barnett Gildesgame [6]. -------- FIXED BY ------------------------------------------------------------ * The XSS issue was fixed by Justin C. Klein Keane [7]. * The access bypass issue was fixed by Ezra Barnett Gildesgame [8] and Earl Miles [9]. -------- CONTACT ------------------------------------------------------------- The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/488104 [3] http://drupal.org/node/488102 [4] http://drupal.org/project/nodequeue [5] http://drupal.org/user/302225 [6] http://drupal.org/user/69959 [7] http://drupal.org/user/302225 [8] http://drupal.org/user/69959 [9] http://drupal.org/user/26979