Drupal Core Image Module HTML Injection Vulnerability
BID:63848
Info
Drupal Core Image Module HTML Injection Vulnerability
| Bugtraq ID: | 63848 |
| Class: | Input Validation Error |
| CVE: |
CVE-2013-6387 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 20 2013 12:00AM |
| Updated: | Apr 13 2015 10:02PM |
| Credit: | Francisco José Cruz Romanos, and Peter Wolanin of the Drupal Security Team. |
| Vulnerable: |
Mandriva Business Server 1 X86 64 Mandriva Business Server 1 Drupal Drupal 7.6 Drupal Drupal 7.5 Drupal Drupal 7.4 Drupal Drupal 7.3 Drupal Drupal 7.23 Drupal Drupal 7.20 Drupal Drupal 7.2 Drupal Drupal 7.19 Drupal Drupal 7.18 Drupal Drupal 7.17 Drupal Drupal 7.16 Drupal Drupal 7.15 Drupal Drupal 7.14 Drupal Drupal 7.13 Drupal Drupal 7.12 Drupal Drupal 7.11 Drupal Drupal 7.10 Drupal Drupal 7.1 Drupal Drupal 7.0 Dev Drupal Drupal 7.0 Alpha7 Drupal Drupal 7.0 Alpha6 Drupal Drupal 7.0 Alpha5 Drupal Drupal 7.0 Alpha4 Drupal Drupal 7.0 Alpha3 Drupal Drupal 7.0 Alpha2 Drupal Drupal 7.0 Alpha1 Drupal Drupal 7.0 Drupal Drupal 6.9 Drupal Drupal 6.8 Drupal Drupal 6.7 Drupal Drupal 6.6 Drupal Drupal 6.5 Drupal Drupal 6.4 Drupal Drupal 6.3 Drupal Drupal 6.28 Drupal Drupal 6.27 Drupal Drupal 6.26 Drupal Drupal 6.23 Drupal Drupal 6.22 Drupal Drupal 6.22 Drupal Drupal 6.2 Drupal Drupal 6.18 Drupal Drupal 6.17 Drupal Drupal 6.16 Drupal Drupal 6.15 Drupal Drupal 6.14 Drupal Drupal 6.13 Drupal Drupal 6.12 Drupal Drupal 6.11 Drupal Drupal 6.10 Drupal Drupal 6.1 Drupal Drupal 6.0 Rc4 Drupal Drupal 6.0 Rc3 Drupal Drupal 6.0 Rc2 Drupal Drupal 6.0 Rc1 Drupal Drupal 6.0 Dev Drupal Drupal 6.0 Beta4 Drupal Drupal 6.0 Beta3 Drupal Drupal 6.0 Beta2 Drupal Drupal 6.0 Beta1 Drupal Drupal 6.0 Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 |
| Not Vulnerable: |
Drupal Drupal 7.24 Drupal Drupal 6.29 |
Discussion
Drupal Core Image Module HTML Injection Vulnerability
Drupal is prone to an HTML-injection vulnerability.
Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.
Drupal core 6.x versions prior to 6.29 and 7.x versions prior to 7.24 are vulnerable.
Drupal is prone to an HTML-injection vulnerability.
Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.
Drupal core 6.x versions prior to 6.29 and 7.x versions prior to 7.24 are vulnerable.
Exploit / POC
Drupal Core Image Module HTML Injection Vulnerability
Attackers can exploit this issue using browser.
Attackers can exploit this issue using browser.
Solution / Fix
Drupal Core Image Module HTML Injection Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Mandriva Business Server 1 X86 64
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Mandriva Business Server 1 X86 64
-
Mandriva drupal-7.24-1.1.mbs1.noarch.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva drupal-7.24-1.mbs1.noarch.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva drupal-mysql-7.24-1.1.mbs1.noarch.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva drupal-mysql-7.24-1.mbs1.noarch.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva drupal-postgresql-7.24-1.1.mbs1.noarch.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva drupal-postgresql-7.24-1.mbs1.noarch.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva drupal-sqlite-7.24-1.1.mbs1.noarch.rpm
http://www.mandriva.com/en/downloads/ -
Mandriva drupal-sqlite-7.24-1.mbs1.noarch.rpm
http://www.mandriva.com/en/downloads/
References
Drupal Core Image Module HTML Injection Vulnerability
References:
References: