BID:33622

Views Bulk Operations Unspecified Cross Site Scripting Vulnerability

Info

Views Bulk Operations Unspecified Cross Site Scripting Vulnerability

Bugtraq ID:	33622
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 04 2009 12:00AM
Updated:	Feb 06 2009 07:48PM
Credit:	Derek Wright
Vulnerable:	Drupal Views bulk operations 6.x-1.3 Drupal Views bulk operations 6.x-1.2 Drupal Views bulk operations 6.x-1.1 Drupal Views bulk operations 6.x-1.0 Drupal Views bulk operations 5.x-1.2 Drupal Views bulk operations 5.x-1.1 Drupal Views bulk operations 5.x-1.0

Not Vulnerable:	Drupal Views bulk operations 6.x-1.4 Drupal Views bulk operations 5.x-1.3

Discussion

Views Bulk Operations Unspecified Cross Site Scripting Vulnerability

'Views bulk operations' is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Exploit / POC

Views Bulk Operations Unspecified Cross Site Scripting Vulnerability

To exploit this issue, an attacker must entice an unsuspecting user into following a malicious URI.

Solution / Fix

Views Bulk Operations Unspecified Cross Site Scripting Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.

Drupal Views bulk operations 5.x-1.0