Drupal Comment Edited Module Unspecified HTML Injection Vulnerability

Bugtraq ID:	45151
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Dec 02 2010 12:00AM
Updated:	Dec 02 2010 12:00AM
Credit:	Reported by the vendor
Vulnerable:	Drupal Comment edited 6.X-1.3 Drupal Comment edited 6.X-1.2 Drupal Comment edited 6.X-1.1
Not Vulnerable:	Drupal Comment edited 6.X-1.4

Drupal Comment Edited Module Unspecified HTML Injection Vulnerability

The Comment Edited module for Drupal is prone to an unspecified HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Versions prior to Comment Edited 6.x-1.4 are vulnerable.

Drupal Comment Edited Module Unspecified HTML Injection Vulnerability

Attackers can use a browser to exploit this issue.

Drupal Comment Edited Module Unspecified HTML Injection Vulnerability

Solution:
Updates are available. Please see the references for details.

Drupal Comment Edited Module Unspecified HTML Injection Vulnerability

References:

• Comment edited Homepage (Drupal)
  
• Drupal Homepage (Drupal)
  
• SA-CONTRIB-2010-106 - Comment Edited - Cross Site Scripting (Drupal)