BID:20631

Drupal Unspecified Cross-Site Scripting Vulnerability

Info

Drupal Unspecified Cross-Site Scripting Vulnerability

Bugtraq ID:	20631
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 19 2006 12:00AM
Updated:	Oct 20 2006 05:48PM
Credit:	Frederic Marand is credited with discovering this issue,
Vulnerable:	OpenPKG OpenPKG 2.5 OpenPKG OpenPKG 2.4 OpenPKG OpenPKG 2.3 OpenPKG OpenPKG 2.2 OpenPKG OpenPKG 2.1 OpenPKG OpenPKG 2.0 OpenPKG OpenPKG Stable Drupal Drupal 4.7.3 Drupal Drupal 4.7.2 Drupal Drupal 4.7.1 Drupal Drupal 4.7 Drupal Drupal 4.6.9 Drupal Drupal 4.6.8 Drupal Drupal 4.6.7 Drupal Drupal 4.6.6 Drupal Drupal 4.6.5 Drupal Drupal 4.6.4 Drupal Drupal 4.6.3 Drupal Drupal 4.6.2 Drupal Drupal 4.6.1 Drupal Drupal 4.6

Not Vulnerable:	Drupal Drupal 4.7.4 Drupal Drupal 4.6.10

Discussion

Drupal Unspecified Cross-Site Scripting Vulnerability

Drupal is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Drupal 4.6x and 4.7x are affected by this issue.

Exploit / POC

Drupal Unspecified Cross-Site Scripting Vulnerability

An attacker can exploit this issue by tricking a victim user into following a malicious URI.

Solution / Fix

Drupal Unspecified Cross-Site Scripting Vulnerability

Solution:
The vendor has released upgrades to address these issues.

Please see the referenced advisories for more information.

Drupal Drupal 4.6