Drupal EU Cookie Compliance Module HTML Injection Vulnerability

Bugtraq ID:	63835
Class:	Input Validation Error
CVE:	CVE-2013-7064
Remote:	Yes
Local:	No
Published:	Nov 20 2013 12:00AM
Updated:	Dec 13 2013 12:17AM
Credit:	Lode Vanstechelman
Vulnerable:
Not Vulnerable:

Drupal EU Cookie Compliance Module HTML Injection Vulnerability

The EU Cookie Compliance module for Drupal is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.

EU Cookie Compliance versions 7.x-1.x through 7.x-1.11 are vulnerable.

Drupal EU Cookie Compliance Module HTML Injection Vulnerability

Attackers can use a browser to exploit this issue.

Drupal EU Cookie Compliance Module HTML Injection Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Drupal EU Cookie Compliance Module HTML Injection Vulnerability

References:

• Drupal Homepage (Drupal)