Drupal Taxonomy Image Module Multiple Unspecified Cross Site Scripting Vulnerabilities

Bugtraq ID:	29683
Class:	Input Validation Error
CVE:	CVE-2008-2773
Remote:	Yes
Local:	No
Published:	Jun 11 2008 12:00AM
Updated:	May 07 2015 05:28PM
Credit:	Owen Barton
Vulnerable:	Drupal Taxonomy image 6.x-1.2 Drupal Taxonomy image 5.x-1.2
Not Vulnerable:	Drupal Taxonomy image 6.x-1.3 Drupal Taxonomy image 5.x-1.3

Drupal Taxonomy Image Module Multiple Unspecified Cross Site Scripting Vulnerabilities

The application is prone to multiple cross-site scripting vulnerabilities because it fails to sanitize user-supplied input to unspecified parameters.

An attacker may leverage these issues to steal cookie-based authentication credentials and launch other attacks.

Versions prior to Taxonomy Image 5.x-1.3 and to 6.x-1.3 are affected.

Drupal Taxonomy Image Module Multiple Unspecified Cross Site Scripting Vulnerabilities

An attacker can exploit these issues by enticing an unsuspecting user to follow a malicious URI.

Drupal Taxonomy Image Module Multiple Unspecified Cross Site Scripting Vulnerabilities

Solution:
The vendor has released patches and an advisory. Please see the references for more information.


Drupal Taxonomy image 6.x-1.2

• Drupal taxonomy_image-5.x-1.3.tar.gz
  http://ftp.drupal.org/files/projects/taxonomy_image-5.x-1.3.tar.gz


• Drupal taxonomy_image-6.x-1.3.tar.gz
  http://ftp.drupal.org/files/projects/taxonomy_image-6.x-1.3.tar.gz

Drupal Taxonomy Image Module Multiple Unspecified Cross Site Scripting Vulnerabilities

References:

• XSS in Drupal Taxonomy Image Module (Drupal)
  
• Drupal Taxonomy Image Module Multiple (Drupal)