Drupal Wikitools Module Multiple Unspecified Cross Site Scripting Vulnerabilities

Bugtraq ID:	34249
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Mar 25 2009 12:00AM
Updated:	Mar 26 2009 06:46PM
Credit:	Charlie Gordon of the Drupal Security Team
Vulnerable:	Drupal Wikitools 6.x-1.x Drupal Wikitools 5.x-1.x
Not Vulnerable:	Drupal Wikitools 6.x-1.1 Drupal Wikitools 5.x-1.3

Drupal Wikitools Module Multiple Unspecified Cross Site Scripting Vulnerabilities

Drupal Wikitools module is prone to multiple unspecified cross-site scripting vulnerabilities.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials.

Drupal Wikitools Module Multiple Unspecified Cross Site Scripting Vulnerabilities

An attacker can exploit these issues by enticing an unsuspecting victim to follow a malicious URI.

Drupal Wikitools Module Multiple Unspecified Cross Site Scripting Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

Drupal Wikitools Module Multiple Unspecified Cross Site Scripting Vulnerabilities

References:

• SA-CONTRIB-2009-016 - Wikitools - Cross site scripting (Drupal)
  
• Wikitools 5.x-1.x prior to 5.x-1.3 (Drupal)
  
• wikitools 6.x-1.1 Release Notes (Drupal)
  
• Wikitools Homepage (Drupal)