* Advisory ID: DRUPAL-SA-CONTRIB-2010-092 * Project: Advanced Book Blocks (third-party module) * Version: 6.x * Date: 2010-September-15 * Security risk: Moderately critical * Exploitable from: Remote * Vulnerability: Cross Site Scripting, Cross Site Request Forgery -------- DESCRIPTION --------------------------------------------------------- The Advanced Book Blocks module enables you to integrate with the API provided by the JQuery Menu module (version 1.8 and higher) to provide click and expand book menus with the ability to customize each block individually. The module contained Cross Site Scripting vulnerabilities which could allow a malicious user with one of several non-default permissions to inject arbitrary javascript into the administrative pages provided by this module. The module also contained Cross Site Request Forgery vulnerabilities which could allow an attacker to trick an administrator into unintentionally deleting or resetting blocks provided by this module. -------- VERSIONS AFFECTED --------------------------------------------------- * Advanced Book Blocks module for Drupal 6.x versions prior to 6.x-2.2 Drupal core is not affected. If you do not use the contributed Advanced Book Blocks [1] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Advanced Book Blocks module for Drupal 6.x upgrade to Advanced Book Blocks 6.x-2.2 [2] See also the Advanced Book Blocks [3]. -------- REPORTED BY --------------------------------------------------------- * Matt Chapman , of the Drupal Security Team. -------- FIXED BY ------------------------------------------------------------ * Aaron Hawkins , the module maintainer. * Matt Chapman , of the Drupal Security Team. -------- CONTACT ------------------------------------------------------------- The Drupal security team [4] can be reached at security at drupal.org or via the form at http://drupal.org/contact. [1] http://drupal.org/project/advancedbookblocks [2] http://drupal.org/node/912586 [3] http://drupal.org/project/advancedbookblocks [4] http://drupal.org/security-team