* Advisory ID: DRUPAL-SA-CONTRIB-2009-019 * Project: Localization client (third-party module) * Versions: 5.x, 6.x * Date: 2009-April-15 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Cross-site scripting (XSS)

-------- DESCRIPTION ---------------------------------------------------------

The Localization client module allows you to translate the interface of your Drupal site from within each page as you go. When displaying translatable strings and their completed translations, the module does not escape the data. If used to translate the Drupal core interface, this is not a problem, since no user input is involved. However, when used with modules such as the Internationalization module suite or Views, user provided data is translated, making the module vulnerable to cross site scripting [1] (XSS). This enables malicious users to insert arbitrary HTML and scripts into certain pages. Such an attack against sufficiently privileged users may lead to adminstrator access to the site.

-------- VERSIONS AFFECTED ---------------------------------------------------

* Versions of Localization client for Drupal 5.x prior to 5.x-1.2 * Versions of Localization client for Drupal 6.x prior to 6.x-1.7

Drupal core is not affected. If you do not use the Localization client module, there is nothing you need to do.

-------- SOLUTION ------------------------------------------------------------

Install the latest version.

* If you use Localization client on Drupal 5, upgrade to Localization client 5.x-1.2 [2] * If you use Localization client on Drupal 6, upgrade to Localization client 6.x-1.7 [3]

-------- REPORTED BY ---------------------------------------------------------

Grégoire Moreau

-------- FIXED BY ------------------------------------------------------------

Roger Lopez, Alexander Hass, Bálint Csuthy, Jose A. Reyero and Gábor Hojtsy

-------- CONTACT -------------------------------------------------------------

The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact [4] and by selecting the security issues category.

[1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/434694 [3] http://drupal.org/node/434688 [4] http://drupal.org/contact