Drupal Userreview Module Unspecified Cross-Site Scripting Vulnerability

Bugtraq ID:	20015
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 14 2006 12:00AM
Updated:	Sep 14 2006 09:07PM
Credit:	The vendor reported this issue.
Vulnerable:	Drupal Userreview Module 4.7
Not Vulnerable:

Drupal Userreview Module Unspecified Cross-Site Scripting Vulnerability

Drupal Userrevew module is prone to an unspecified cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Drupal 4.7 is affected by this issue. Versions lacking the following CVS $Id$ field are vulnerable:

'Drupal 4.7 - // $Id: userreview.module,v 1.19 2006/09/12 18:12:21 killes Exp $'

Drupal Userreview Module Unspecified Cross-Site Scripting Vulnerability

An attacker can exploit this issue by tricking a victim user into following a malicious URI.

Drupal Userreview Module Unspecified Cross-Site Scripting Vulnerability

Solution:
The vendor has released upgrades to address these issues. The latest versions available from the vendor's site are not affected.

Please see the referenced advisories for more information.

Drupal Userreview Module Unspecified Cross-Site Scripting Vulnerability

References:

• Userreview cross site scripting vulnerability (Drupal)
  
• Vendor Homepage (Drupal)