[Security-news] SA-CONTRIB-2010-060 - Scheduler - Cross Site Scripting

[security-news at drupal.org]

  * Advisory ID: DRUPAL-SA-CONTRIB-2010-060
  * Project: Scheduler (third-party module)
  * Version: 5.x, 6.x
  * Date: 2010-May-26
  * Security risk: Moderately critical
  * Exploitable from: Remote
  * Vulnerability: Cross Site Scripting

-------- DESCRIPTION  
---------------------------------------------------------

Scheduler allows nodes to be published and unpublished on specified dates.
Scheduler does not sanitize titles for unpublished nodes on the scheduled
nodes overview list, leading to a Cross Site Scripting (XSS [1])
vulnerability that may lead to a malicious user gaining full administrative
access. The risk is mitigated by the fact that an attacker must succeed in a)
creating a node that is b) scheduled (requires "schedule (un)publishing of
nodes" permission) and c) unpublished.
-------- VERSIONS AFFECTED  
---------------------------------------------------

  * Scheduler module for Drupal 5.x versions prior to 5.x-1-19
  * Scheduler module for Drupal 6.x versions prior to 6.x-1.7

Drupal core is not affected. If you do not use the contributed Scheduler [2]
module, there is nothing you need to do.
-------- SOLUTION  
------------------------------------------------------------

Install the latest version:
  * If you use the Scheduler module for Drupal 5.x upgrade to Scheduler
    5.x-1-19 [3]
  * If you use the Scheduler module for Drupal 6.x upgrade to Scheduler
    6.x-1.7 [4]

See also the Scheduler project page [5].
-------- REPORTED BY  
---------------------------------------------------------

  * mr.baileys [6] of the Drupal security team

-------- FIXED BY  
------------------------------------------------------------

  * Eric Schaefer [7], module maintainer

-------- CONTACT  
-------------------------------------------------------------

The Drupal security team [8] can be reached at security at drupal.org or via
the form at http://drupal.org/contact.

[1] http://en.wikipedia.org/wiki/Cross-site_scripting
[2] http://drupal.org/project/scheduler
[3] http://drupal.org/node/809136
[4] http://drupal.org/node/809134
[5] http://drupal.org/project/scheduler
[6] http://drupal.org/user/383424
[7] http://drupal.org/user/20786
[8] http://drupal.org/security-team