Drupal Email Verification Module Cross Site Scripting and Information Disclosure Vulnerabilities
BID:35050
Info
Drupal Email Verification Module Cross Site Scripting and Information Disclosure Vulnerabilities
| Bugtraq ID: | 35050 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | May 20 2009 12:00AM |
| Updated: | May 21 2009 05:50PM |
| Credit: | Reported by the vendor |
| Vulnerable: |
Drupal Email Verification 6.x-1.x Drupal Email Verification 5.x-1.x |
| Not Vulnerable: |
Drupal Email Verification 6.x-1.2 Drupal Email Verification 5.x-2.1 |
Discussion
Drupal Email Verification Module Cross Site Scripting and Information Disclosure Vulnerabilities
Drupal Email Verification module is prone to multiple cross-site scripting vulnerabilities and an information-disclosure vulnerability.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, and obtain sensitive information.
The following are vulnerable:
Email Verification 5.x-1.x (prior to 5.x-2.1)
Email Verification 6.x (prior to 6.x-1.2)
Drupal Email Verification module is prone to multiple cross-site scripting vulnerabilities and an information-disclosure vulnerability.
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, and obtain sensitive information.
The following are vulnerable:
Email Verification 5.x-1.x (prior to 5.x-2.1)
Email Verification 6.x (prior to 6.x-1.2)
Exploit / POC
Drupal Email Verification Module Cross Site Scripting and Information Disclosure Vulnerabilities
Attackers can use a browser to exploit these issues. To exploit a cross-site scripting vulnerability, an attacker must entice an unsuspecting victim to follow a malicious URI.
Attackers can use a browser to exploit these issues. To exploit a cross-site scripting vulnerability, an attacker must entice an unsuspecting victim to follow a malicious URI.
Solution / Fix
Drupal Email Verification Module Cross Site Scripting and Information Disclosure Vulnerabilities
Solution:
The vendor has released an update. Please see the references for details.
Drupal Email Verification 5.x-1.x
Drupal Email Verification 6.x-1.x
Solution:
The vendor has released an update. Please see the references for details.
Drupal Email Verification 5.x-1.x
-
Drupal email_verify-5.x-2.1.tar.gz
http://ftp.drupal.org/files/projects/email_verify-5.x-2.1.tar.gz
Drupal Email Verification 6.x-1.x
-
Drupal email_verify-6.x-1.2.tar.gz
http://ftp.drupal.org/files/projects/email_verify-6.x-1.2.tar.gz
References
Drupal Email Verification Module Cross Site Scripting and Information Disclosure Vulnerabilities
References:
References: