Drupal Simplenews Module CVE-2013-4447 HTML Injection Vulnerability

Bugtraq ID:	63175
Class:	Input Validation Error
CVE:	CVE-2013-4447
Remote:	Yes
Local:	No
Published:	Oct 16 2013 12:00AM
Updated:	Oct 22 2013 12:15AM
Credit:	Pat Redmond
Vulnerable:	Drupal Simplenews 6.X-1.4 Drupal Simplenews 6.X-1.3 Drupal Simplenews 6.x-1.0-Beta 4 Drupal Simplenews 6.x-1.0-Beta 3 Drupal Simplenews 6.x-1.0--Beta 3
Not Vulnerable:

Drupal Simplenews Module CVE-2013-4447 HTML Injection Vulnerability

The Simplenews module for Drupal is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied data.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.

The following versions are affected:

Simplenews 6.x-1.x versions prior to 6.x-1.5
Simplenews 7.x-1.x versions prior to 7.x-1.1

Drupal Simplenews Module CVE-2013-4447 HTML Injection Vulnerability

An attacker can exploit this issue using a web browser.

Drupal Simplenews Module CVE-2013-4447 HTML Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Drupal Simplenews Module CVE-2013-4447 HTML Injection Vulnerability

References:

• Drupal Simplenews Module Homepage (Drupal)