Drupal Ubercart Views and Ubercart Modules 'full name' field HTML Injection Vulnerability

Bugtraq ID:	58065
Class:	Input Validation Error
CVE:	CVE-2013-0321 CVE-2013-0322
Remote:	Yes
Local:	No
Published:	Feb 20 2013 12:00AM
Updated:	Feb 21 2013 08:22AM
Credit:	20th
Vulnerable:	Drupal Ubercart Views 6.X-3.2 Drupal Ubercart 7.x-3.1 Drupal Ubercart 7.x-3.0
Not Vulnerable:

Drupal Ubercart Views and Ubercart Modules 'full name' field HTML Injection Vulnerability

The Ubercart Views and the Ubercart module for Drupal is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied text.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.

Drupal Ubercart Views and Ubercart Modules 'full name' field HTML Injection Vulnerability

Attackers can use a browser to exploit this issue.

Drupal Ubercart Views and Ubercart Modules 'full name' field HTML Injection Vulnerability

Solution:
Vendor updates are available. Please see the references for more information.

Drupal Ubercart Views and Ubercart Modules 'full name' field HTML Injection Vulnerability

References: