Multiple Drupal Modules Date Wizard HTML Injection Vulnerability

Bugtraq ID:	35790
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Jul 24 2009 12:00AM
Updated:	Jul 31 2009 08:14PM
Credit:	Justin C. Klein Keane
Vulnerable:	Red Hat Fedora 11 Red Hat Fedora 10 Drupal Views 6.x-2.6 Drupal Date 6.x-2.2 Drupal Calendar 6.x-2.1
Not Vulnerable:	Drupal Date 6.x-2.3 Drupal Calendar 6.x-2.2

Multiple Drupal Modules Date Wizard HTML Injection Vulnerability

Multiple Drupal modules are prone to an HTML-injection vulnerability because the applications fail to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

The following modules and versions are affected:

Date 6.x-2.2
Calendar 6.x-2
Views 6.x-2.6

Multiple Drupal Modules Date Wizard HTML Injection Vulnerability

Attackers can use a browser to exploit this issue.

Multiple Drupal Modules Date Wizard HTML Injection Vulnerability

Solution:
Updates are available. Please see the references for details.


Drupal Date 6.x-2.2

• Drupal http://ftp.drupal.org/files/projects/
  http://ftp.drupal.org/files/projects/date-6.x-2.3.tar.gz

Drupal Calendar 6.x-2.1

• Drupal calendar-6.x-2.2.tar.gz
  http://ftp.drupal.org/files/projects/calendar-6.x-2.2.tar.gz

Multiple Drupal Modules Date Wizard HTML Injection Vulnerability

References:

• Calendar Homepage (Drupal)
  
• Date Homepage (Drupal)
  
• Drupal Language Switcher Dropdown Homepage (Drupal)
  
• SA-CONTRIB-2009-046 - Date - Cross Site Scripting (Drupal)
  
• SA-CONTRIB-2009-047 - Calendar - Cross Site Scripting (Drupal)