Drupal Protest Module Cross Site Scripting Vulnerability

Bugtraq ID:	54855
Class:	Input Validation Error
CVE:	CVE-2012-2726
Remote:	Yes
Local:	No
Published:	Jun 06 2012 12:00AM
Updated:	Jun 06 2012 12:00AM
Credit:	Shawn Price
Vulnerable:	Drupal Protest 7.x-1.0 Drupal Protest 6.X-1.0
Not Vulnerable:	Drupal Protest 7.x-1.2 Drupal Protest 6.X-1.2

Drupal Protest Module Cross Site Scripting Vulnerability

The Protest module for Drupal is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input before being printed back to the user.

An attacker may leverage this issue to execute arbitrary HTML and script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Protest 6.x-1.x versions prior to 6.x-1.2 and 7.x-1.x versions prior to 7.x-1.2 are vulnerable.

Drupal Protest Module Cross Site Scripting Vulnerability

An attacker can exploit the issue by enticing an unsuspecting user to visit a specially crafted URL.

Drupal Protest Module Cross Site Scripting Vulnerability

Solution:
Updates are available; please see the references for details.


Drupal Protest 6.X-1.0

• Drupal protest 6.x-1.2
  http://drupal.org/node/1618090

Drupal Protest 7.x-1.0

• Drupal protest 7.x-1.2
  http://drupal.org/node/1618092

Drupal Protest Module Cross Site Scripting Vulnerability

References:

• Protest Homepage (Drupal)
  
• SA-CONTRIB-2012-097 - Protest - Cross Site Scripting (XSS) (Drupal)