[Security-news] SA-CONTRIB-2011-010 - Messaging - Cross Site Scripting

[security-news at drupal.org]

  * Advisory ID: DRUPAL-SA-CONTRIB-2011-010
  * Project: Messaging (third-party module)
  * Version: 6.x
  * Date: 2011-February-16
  * Security risk: Moderately critical
  * Exploitable from: Remote
  * Vulnerability: Cross Site Scripting

The Messaging module is a Framework to allow message sending in a channel
independent way. It provides a common API for message composition and sending
while allowing plug-ins for multiple messaging methods. The module does not
sanitize some of the user-supplied data before displaying it, leading to a
Cross Site Scripting (XSS [1]) vulnerability that may lead to a malicious
user gaining full administrative access. This vulnerability is mitigated by
the fact that the attacker must have a role with the 'administer messaging'
permission which should generally only be granted to trusted roles.
-------- VERSIONS AFFECTED  
---------------------------------------------------

  * Messaging module for Drupal 6.x versions prior to 6.x-2.4 and
    6.x-4.0-beta8

Drupal core is not affected. If you do not use the contributed Messaging [2]
module, there is nothing you need to do.
-------- SOLUTION  
------------------------------------------------------------

Install the latest version:
  * If you use the Messaging module version 6.x-2.x upgrade to Messaging
    6.x-2.4 [3]
  * If you use the Messaging module version 6.x-4.x upgrade to Messaging
    6.x-4.0-beta8 [4]

See also the Messaging project page [5].
-------- REPORTED BY  
---------------------------------------------------------

  * Justin Klein Keane [6]

-------- FIXED BY  
------------------------------------------------------------

  * Jose Reyero [7], module maintainer

-------- CONTACT  
-------------------------------------------------------------

The Drupal security team [8] can be reached at security at drupal.org [9] or
via the form at http://drupal.org/contact [10].


[1] http://en.wikipedia.org/wiki/Cross-site_scripting
[2] http://drupal.org/project/messaging
[3] http://drupal.org/node/1064014
[4] http://drupal.org/node/1064026
[5] http://drupal.org/project/messaging
[6] http://drupal.org/user/302225
[7] http://drupal.org/user/4299
[8] http://drupal.org/security-team
[9] http://drupal.org
[10] http://drupal.org/contact