Drupal Printer, e-mail and PDF version Module Security Bypass and HTML Injection Vulnerabilities

Bugtraq ID:	36707
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 15 2009 12:00AM
Updated:	Oct 16 2009 08:08PM
Credit:	mcarbone
Vulnerable:	Drupal Printer, e-mail and PDF versions 6.x-1.8 Drupal Printer, e-mail and PDF versions 5.x-4.8
Not Vulnerable:	Drupal Printer, e-mail and PDF versions 6.x-1.9 Drupal Printer, e-mail and PDF versions 5.x-4.9

Drupal Printer, e-mail and PDF version Module Security Bypass and HTML Injection Vulnerabilities

Drupal 'Printer, e-mail and PDF version' module is prone to a security-bypass vulnerability and an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, control how the site is rendered to the user, or perform unauthorized actions; other attacks may also be possible.

Drupal Printer, e-mail and PDF version Module Security Bypass and HTML Injection Vulnerabilities

Attackers can use a browser to exploit these issues.

Drupal Printer, e-mail and PDF version Module Security Bypass and HTML Injection Vulnerabilities

Solution:
Updates are available. Please see the references for details.

Drupal Printer, e-mail and PDF version Module Security Bypass and HTML Injection Vulnerabilities

References:

• Drupal Language Switcher Dropdown Homepage (Drupal)
  
• DRUPAL-SA-CONTRIB-2009-073 - Printer, e-mail and PDF versions multiple vulnerabi (Drupal)
  
• print 5.x-4.9 (Drupal)
  
• print 6.x-1.9 (Drupal)