Drupal Service Links Component Content Type Names HTML Injection Vulnerability

Bugtraq ID:	36584
Class:	Input Validation Error
CVE:	CVE-2009-3648
Remote:	Yes
Local:	No
Published:	Oct 02 2009 12:00AM
Updated:	May 07 2015 05:20PM
Credit:	Justin Klein Keane
Vulnerable:	Drupal Service Links 6.x-1.0
Not Vulnerable:

Drupal Service Links Component Content Type Names HTML Injection Vulnerability

The Service Links component for Drupal is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits would allow an attacker to execute arbitrary script and HTML code in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Service Links 6.x-1.0 is vulnerable; other versions may also be affected.

Drupal Service Links Component Content Type Names HTML Injection Vulnerability

Attackers can use a browser to exploit this issue.

Drupal Service Links Component Content Type Names HTML Injection Vulnerability

Solution:
Updates are available. Please see the references for more information.

Drupal Service Links Component Content Type Names HTML Injection Vulnerability

References:

• Drupal Homepage (Drupal)
  
• Service Links Homepage (Drupal)