Drupal Archive Module Cross-Site Scripting Vulnerabilities

Bugtraq ID:	27436
Class:	Input Validation Error
CVE:	CVE-2008-0462
Remote:	Yes
Local:	No
Published:	Jan 23 2008 12:00AM
Updated:	May 07 2015 05:33PM
Credit:	Gábor Hojtsy is credited with the discovery of these vulnerabilities.
Vulnerable:	Drupal Archive Module 5.x-1.7 Drupal Archive Module 5.x-1.6 Drupal Archive Module 5.x-1.5
Not Vulnerable:	Drupal Archive Module 5.x-1.8

Drupal Archive Module Cross-Site Scripting Vulnerabilities

The Archive module for Drupal is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

These issues affect versions prior to Archive 5.x-1.8.

Drupal Archive Module Cross-Site Scripting Vulnerabilities

To exploit these issues, an attacker must entice an unsuspecting user to follow a malicious URI.

Drupal Archive Module Cross-Site Scripting Vulnerabilities

Solution:
The vendor released an update to address these issues. Please see the references for more information.

Drupal Archive Module Cross-Site Scripting Vulnerabilities

References:

• Archive Module Homepage (Drupal)
  
• Vendor Homepage (Drupal)
  
• SA-2008-10 - Archive - Cross site scripting (Drupal)