Drupal Date Module 'date' CCK Field HTML Injection Vulnerability

Bugtraq ID:	36428
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Sep 16 2009 12:00AM
Updated:	Apr 13 2015 10:00PM
Credit:	The Acquia, Inc. Support Team <br>
Vulnerable:	Drupal Date 6.X-2.3 Drupal Date 5.x-2.7
Not Vulnerable:	Drupal Date 6.x-2.4 Drupal Date 5.x-2.8

Drupal Date Module 'date' CCK Field HTML Injection Vulnerability

The Date module for Drupal is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Versions prior to Date 6.x-2.4 and 5.x-2.8 are vulnerable.

Drupal Date Module 'date' CCK Field HTML Injection Vulnerability

Attackers can use a browser to exploit this issue.

Drupal Date Module 'date' CCK Field HTML Injection Vulnerability

Solution:
Updates are available. Please see the references for more information.

Drupal Date Module 'date' CCK Field HTML Injection Vulnerability

References:

• date 5.x-2.8 (Drupal)
  
• date 6.x-2.4 (Drupal)
  
• Date Homepage (Drupal)
  
• DRUPAL-SA-CONTRIB-2009-057 - Date - Cross Site Scripting (Drupal)