[Security-news] SA-CONTRIB-2009-081 - Abuse - Cross Site Scripting

[security-news at drupal.org]

  * Advisory ID: DRUPAL-SA-CONTRIB-2009-081
  * Project: Abuse (third-party module)
  * Version: 5.x, 6.x
  * Date: 2009 October 21
  * Security risk: Critical
  * Exploitable from: Remote
  * Vulnerability: Cross Site Scripting

-------- DESCRIPTION  
---------------------------------------------------------

The Abuse module enables users to flag nodes and comments as offensive,
bringing them to the attention of the site maintainer for review. The module
suffers from a Cross Site Scripting (Cross Site Scripting [1]) vulnerability.
Such an attack may lead to a malicious user gaining full administrative
access.
-------- VERSIONS AFFECTED  
---------------------------------------------------

  * Abuse 6.x prior to 6.x-1.1-alpha1
  * Abuse 5.x prior to 5.x-2.1

Drupal core is not affected. If you do not use the contributed Abuse module,
there is nothing you need to do.
-------- SOLUTION  
------------------------------------------------------------

Upgrade to the latest version:
  * If you use Abuse for Drupal 6.x upgrade to version 6.x-1.1-alpha1 [2]
  * If you use Abuse for Drupal 5.x upgrade to version 5.x-2.1 [3]

-------- REPORTED BY  
---------------------------------------------------------

  * Reported by Mustafa ULU [4].

-------- FIXED BY  
------------------------------------------------------------

  * Fixed by Ashok Modi [5].

-------- CONTACT  
-------------------------------------------------------------

The security contact for Drupal can be reached at security at drupal.org or
via the form at http://drupal.org/contact.

[1] http://en.wikipedia.org/wiki/XSS
[2] http://drupal.org/node/610900
[3] http://drupal.org/node/610784
[4] http://drupal.org/user/207559
[5] http://drupal.org/user/60422