Drupal Core Color Module Cross Site Scripting Vulnerability
BID:63847
Info
Drupal Core Color Module Cross Site Scripting Vulnerability
| Bugtraq ID: | 63847 |
| Class: | Input Validation Error |
| CVE: |
CVE-2013-6388 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 20 2013 12:00AM |
| Updated: | May 07 2015 05:07PM |
| Credit: | Mauro Gentile |
| Vulnerable: |
Mandriva Business Server 1 X86 64 Mandriva Business Server 1 Drupal Drupal 7.6 Drupal Drupal 7.5 Drupal Drupal 7.4 Drupal Drupal 7.3 Drupal Drupal 7.23 Drupal Drupal 7.20 Drupal Drupal 7.2 Drupal Drupal 7.19 Drupal Drupal 7.18 Drupal Drupal 7.17 Drupal Drupal 7.16 Drupal Drupal 7.15 Drupal Drupal 7.14 Drupal Drupal 7.13 Drupal Drupal 7.12 Drupal Drupal 7.11 Drupal Drupal 7.10 Drupal Drupal 7.1 Drupal Drupal 7.0 Dev Drupal Drupal 7.0 Alpha7 Drupal Drupal 7.0 Alpha6 Drupal Drupal 7.0 Alpha5 Drupal Drupal 7.0 Alpha4 Drupal Drupal 7.0 Alpha3 Drupal Drupal 7.0 Alpha2 Drupal Drupal 7.0 Alpha1 Drupal Drupal 7.0 Drupal Drupal 6.9 Drupal Drupal 6.8 Drupal Drupal 6.7 Drupal Drupal 6.6 Drupal Drupal 6.5 Drupal Drupal 6.4 Drupal Drupal 6.3 Drupal Drupal 6.28 Drupal Drupal 6.27 Drupal Drupal 6.26 Drupal Drupal 6.23 Drupal Drupal 6.22 Drupal Drupal 6.22 Drupal Drupal 6.2 Drupal Drupal 6.18 Drupal Drupal 6.17 Drupal Drupal 6.16 Drupal Drupal 6.15 Drupal Drupal 6.14 Drupal Drupal 6.13 Drupal Drupal 6.12 Drupal Drupal 6.11 Drupal Drupal 6.10 Drupal Drupal 6.1 Drupal Drupal 6.0 Rc4 Drupal Drupal 6.0 Rc3 Drupal Drupal 6.0 Rc2 Drupal Drupal 6.0 Rc1 Drupal Drupal 6.0 Dev Drupal Drupal 6.0 Beta4 Drupal Drupal 6.0 Beta3 Drupal Drupal 6.0 Beta2 Drupal Drupal 6.0 Beta1 Drupal Drupal 6.0 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 |
| Not Vulnerable: |
Drupal Drupal 7.24 Drupal Drupal 6.29 |
Discussion
Drupal Core Color Module Cross Site Scripting Vulnerability
Drupal is prone to a cross-site scripting vulnerability.
An attacker can exploit this issue to execute arbitrary script code in the context of the vulnerable site, potentially allowing the attacker to steal cookie-based authentication credentials.
Drupal core 6.x versions prior to 6.29 and 7.x versions prior to 7.24 are vulnerable.
Drupal is prone to a cross-site scripting vulnerability.
An attacker can exploit this issue to execute arbitrary script code in the context of the vulnerable site, potentially allowing the attacker to steal cookie-based authentication credentials.
Drupal core 6.x versions prior to 6.29 and 7.x versions prior to 7.24 are vulnerable.
Exploit / POC
Drupal Core Color Module Cross Site Scripting Vulnerability
Attackers can exploit this issue using browser. To exploit a cross-site scripting issue the attacker needs to entice a user into following a malicious URI.
Attackers can exploit this issue using browser. To exploit a cross-site scripting issue the attacker needs to entice a user into following a malicious URI.
Solution / Fix
Drupal Core Color Module Cross Site Scripting Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Mandriva Business Server 1 X86 64
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Mandriva Business Server 1 X86 64
-
Mandriva drupal-7.24-1.1.mbs1.noarch.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva drupal-7.24-1.mbs1.noarch.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva drupal-mysql-7.24-1.1.mbs1.noarch.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva drupal-mysql-7.24-1.mbs1.noarch.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva drupal-postgresql-7.24-1.1.mbs1.noarch.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva drupal-postgresql-7.24-1.mbs1.noarch.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva drupal-sqlite-7.24-1.1.mbs1.noarch.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva drupal-sqlite-7.24-1.mbs1.noarch.rpm
http://www.mandriva.com/en/downloads/
References
Drupal Core Color Module Cross Site Scripting Vulnerability
References:
References: