Drupal Project Module HTML Injection Vulnerability
BID:17885
Info
Drupal Project Module HTML Injection Vulnerability
| Bugtraq ID: | 17885 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 08 2006 12:00AM |
| Updated: | May 09 2006 07:54PM |
| Credit: | The vendor reported this vulnerability. |
| Vulnerable: |
Drupal Drupal 4.6.3 Drupal Drupal 4.6.2 Drupal Drupal 4.6.1 Drupal Drupal 4.6 Drupal Drupal 4.5.5 Drupal Drupal 4.5.4 Drupal Drupal 4.5.3 Drupal Drupal 4.5.2 Drupal Drupal 4.5.2 Drupal Drupal 4.5.1 Drupal Drupal 4.5 |
| Not Vulnerable: | |
Discussion
Drupal Project Module HTML Injection Vulnerability
Drupal is prone to an HTML-injection vulnerability. This issue is due to the application's failure to properly sanitize user-supplied input before using it in dynamically generated content.
Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing the attacker to steal cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.
Drupal is prone to an HTML-injection vulnerability. This issue is due to the application's failure to properly sanitize user-supplied input before using it in dynamically generated content.
Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing the attacker to steal cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.
Exploit / POC
Drupal Project Module HTML Injection Vulnerability
This issue can be exploited through a web client.
This issue can be exploited through a web client.
Solution / Fix
Drupal Project Module HTML Injection Vulnerability
Solution:
The vendor has released an update addressing this issue in all versions prior to 4.7.0; please see the reference section for further details.
Solution:
The vendor has released an update addressing this issue in all versions prior to 4.7.0; please see the reference section for further details.
References
Drupal Project Module HTML Injection Vulnerability
References:
References:
- Drupal 4.7.0 released (Drupal)
- Vendor Homepage (Drupal)