* Advisory ID: DRUPAL-SA-CONTRIB-2010-010 * Project: Author Contact (third-party module) * Version: 5.x, 6.x * Date: 2010-January-27 * Security risk: Less critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting

-------- DESCRIPTION ---------------------------------------------------------

The Author Contact module provides a form to contact the author of the current post. The module does not properly sanitize parts of the provided block, leading to a cross-site scripting (XSS [1]) vulnerability. Such an attack may lead to a malicious user gaining full administrative access. A user must have a role with the permission /administer blocks/ to exploit. -------- VERSIONS AFFECTED ---------------------------------------------------

* Author Contact for Drupal 6.x prior to 6.x-1.3 * Author Contact for Drupal 5.x prior to 5.x-1.3

Drupal core is not affected. If you do not use the contributed Author Contact module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------

Upgrade to the latest version: * If you use Author Contact for Drupal 6.x upgrade to Author Contact 6.x-1.3 [2] * If you use Author Contact for Drupal 5.x upgrade to Author Contact 5.x-1.3 [3]

See also the Author Contact project page [4]. -------- REPORTED BY ---------------------------------------------------------

* mr.baileys [5]

-------- FIXED BY ------------------------------------------------------------

* James Crook [6], the module maintainer * Benjamin Jeavons [7]

-------- CONTACT -------------------------------------------------------------

The security contact for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact.

[1] http://en.wikipedia.org/wiki/Cross-site_scripting [2] http://drupal.org/node/694238 [3] http://drupal.org/node/693896 [4] http://drupal.org/project/authorcontact [5] http://drupal.org/user/383424 [6] http://drupal.org/user/204495 [7] http://drupal.org/user/91990