Drupal Javascript Tool Multiple Arbitrary File Access and File Disclosure Vulnerabilities

Bugtraq ID:	55287
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 29 2012 12:00AM
Updated:	Aug 29 2012 12:00AM
Credit:	Klaus Purer
Vulnerable:
Not Vulnerable:

Drupal Javascript Tool Multiple Arbitrary File Access and File Disclosure Vulnerabilities

The Javascript Tool for Drupal is prone to an arbitrary file-access vulnerability and a remote file-disclosure vulnerability because the application fails to adequately sanitize user-supplied input.

An attacker can exploit these issues to view the contents of arbitrary files or to gain read/write access to arbitrary files in the context of the web server process, which may aid in further attacks.

Javascript Tool 7.x-1.x versions prior to 7.x-1.7 are vulnerable.

Drupal Javascript Tool Multiple Arbitrary File Access and File Disclosure Vulnerabilities

Attackers can exploit these issues through a browser.

Drupal Javascript Tool Multiple Arbitrary File Access and File Disclosure Vulnerabilities

Solution:
Vendor updates are available. Please see the references for more information.

Drupal Javascript Tool Multiple Arbitrary File Access and File Disclosure Vulnerabilities

References:

• Drupal Homepage (Drupal)