Drupal Easylinks Module Unspecified Cross-Site Scripting Vulnerability

Bugtraq ID:	19670
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 23 2006 12:00AM
Updated:	Sep 04 2006 07:13PM
Credit:	The vendor reported this issue.
Vulnerable:	Drupal Easylinks Module 4.7
Not Vulnerable:	Drupal Easylinks Module 4.7.1.5.2.1 2006/08/

Drupal Easylinks Module Unspecified Cross-Site Scripting Vulnerability

Drupal Easylinks module is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Drupal Easylinks module 4.7 revisions older than 'easylinks.module,v 1.5.2.1 2006/08/19 12:02:27' are affected.

Drupal Easylinks Module Unspecified Cross-Site Scripting Vulnerability

An attacker can exploit this issue by tricking a victim user into following a malicious URI.

Drupal Easylinks Module Unspecified Cross-Site Scripting Vulnerability

Solution:
The vendor has released upgrades to address these issues. The latest versions available from the vendor's site are not affected.

Please see the referenced advisories for more information.

Drupal Easylinks Module Unspecified Cross-Site Scripting Vulnerability

References:

• Easylinks multiple vulnerabilities (Drupal)
  
• Vendor Homepage (Drupal)