[Security-news] SA-CONTRIB-2009-020 - Print - Cross site scripting

[security-news at drupal.org]

 * Advisory ID: DRUPAL-SA-CONTRIB-2009-020
 * Project: Printer, e-mail and PDF versions (third-party module)
 * Version: 5.x, 6.x
 * Date: 2009-April-15
 * Security risk: Moderately critical
 * Exploitable from: Remote
 * Vulnerability: Cross-site scripting (XSS)

-------- DESCRIPTION ---------------------------------------------------------

The Printer, e-mail and PDF versions ("Print") module provides
printer-friendly versions of content. The module does not correctly escape
content titles, enabling malicious users to insert arbitrary HTML and scripts
into certain pages. Such a cross site scripting [1] (XSS) attack against
sufficiently privileged users may lead to administrator access to the site.

-------- VERSIONS AFFECTED ---------------------------------------------------

 * Versions of Printer, e-mail and PDF versions for Drupal 5.x prior to
   5.x-4.5
 * Versions of Printer, e-mail and PDF versions for Drupal 6.x prior to
   6.x-1.5

Drupal core is not affected. If you do not use the contributed Printer,
e-mail and PDF versions module, there is nothing you need to do.

-------- SOLUTION ------------------------------------------------------------

Install the latest version:

 * If you use Printer, e-mail and PDF versions for Drupal 5.x upgrade to
   Printer, e-mail and PDF versions 5.x-4.5 [2]
 * If you use Printer, e-mail and PDF versions for Drupal 5.x upgrade to
   Printer, e-mail and PDF versions 6.x-1.5 [3]

See also the Printer, e-mail and PDF versions project page [4].

-------- REPORTED BY ---------------------------------------------------------

Stéphane Corlosquet [5]

-------- FIXED BY ------------------------------------------------------------

Peter Wolanin [6]

-------- CONTACT -------------------------------------------------------------

The security contact for Drupal can be reached at security at drupal.org or
via the form at http://drupal.org/contact [7].


[1] http://en.wikipedia.org/wiki/Cross-site_scripting
[2] http://drupal.org/node/434718
[3] http://drupal.org/node/434720
[4] http://drupal.org/project/print
[5] http://drupal.org/user/52142
[6] http://drupal.org/user/49851
[7] http://drupal.org/contact