* Advisory ID: SA-CONTRIB-2010-076 * Project: Dashboard (third-party module) * Version: 6.x * Date: 2010-July-28 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION: -------------------------------------------------------- The dashboard module allows users to create a personalized set of pages of widgets created from existing blocks and nodes (like iGoogle). The module does not escape user generated names for tags & titles associated with default widgets that are added to a user dashboard page, leading to a Cross Site Scripting (XSS [1]) vulnerability. Users with the permission to access or create default dashboard widgets is vulnerable to attack. A malicious user needs the permission "administer dashboard defaults" to exploit the vulnerability. -------- VERSIONS AFFECTED: -------------------------------------------------- * Dashboard module for Drupal 6.x versions prior to 6.x-2.1 [2] Drupal core is not affected. If you do not use the contributed Dashboard [3] module, there is nothing you need to do. -------- SOLUTION: ----------------------------------------------------------- Install the latest version: * Upgrade to Dashboard 6.x-2.1 [4] See also the Dashboard project page [5]. -------- REPORTED BY: -------------------------------------------------------- * Greg Knaddison (greggles) [6] a member of the Drupal Security Team -------- FIXED BY: ----------------------------------------------------------- * Chris Miller [7], module maintainer * Greg Knaddison (greggles) [8] a member of the Drupal Security Team The Drupal security team [9] can be reached at security at drupal.org [10] or via the form at http://drupal.org/contact [11]. [1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/866628 [3] http://drupal.org/project/dashboard [4] http://drupal.org/node/866628 [5] http://drupal.org/project/dashboard [6] http://drupal.org/user/36762 [7] http://drupal.org/user/274027 [8] http://drupal.org/user/36762 [9] http://drupal.org/security-team [10] http://drupal.org [11] http://drupal.org/contact