[Security-news] SA-CONTRIB-2011-007 - Userpoints Cross Site Scripting

[security-news at drupal.org]

  * Advisory ID: DRUPAL-SA-CONTRIB-2011-007
  * Project: Userpoints (third-party module)
  * Version: 6.x
  * Date: 2011-February-02
  * Security risk: Moderately critical
  * Exploitable from: Remote
  * Vulnerability: Cross Site Scripting

-------- DESCRIPTION  
---------------------------------------------------------

The Userpoints module allows users to gain points through specific actions
like contributing content. The module does not sanitize some of the
user-supplied data before displaying it, leading to a Cross Site Scripting
(XSS [1]) vulnerability that may lead to a malicious user gaining full
administrative access. This vulnerability is mitigated by the fact that the
attacker must have a role with the "administer userpoints" permission.

-------- VERSIONS AFFECTED  
---------------------------------------------------

  * Userpoints module for Drupal 6.x versions prior to 6.x-1.2

Drupal core is not affected. If you do not use the contributed Userpoints [2]
module, there is nothing you need to do.

-------- SOLUTION  
------------------------------------------------------------

Install the latest version:

  * If you use the Userpoints module for Drupal 6.x upgrade to Userpoints
    6.x-1.2 [3]

See also the Userpoints project page [4].

-------- REPORTED BY  
---------------------------------------------------------

  * Sascha Grossenbacher (Berdir) [5], Userpoints module maintainer

-------- FIXED BY  
------------------------------------------------------------

  * Sascha Grossenbacher (Berdir) [6], Userpoints module maintainer

-------- CONTACT AND MORE INFORMATION  
----------------------------------------

The Drupal security team can be reached at security at drupal.org [7] or via
the form at http://drupal.org/contact [8].
Learn more about the team and their policies [9], writing secure code for
Drupal [10], and secure configuration [11] of your site.


[1] http://en.wikipedia.org/wiki/Cross-site_scripting
[2] http://drupal.org/project/userpoints
[3] http://drupal.org/node/1048946
[4] http://drupal.org/project/userpoints
[5] http://drupal.org/user/214652
[6] http://drupal.org/user/214652
[7] http://drupal.org
[8] http://drupal.org/contact
[9] http://drupal.org/security-team
[10] http://drupal.org/writing-secure-code
[11] http://drupal.org/security/secure-configuration