Drupal Maestro Module Mutiple Cross Site Scripting Vulnerabilities

Bugtraq ID:	65677
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 19 2014 12:00AM
Updated:	Feb 19 2014 12:00AM
Credit:	Aron Novak
Vulnerable:
Not Vulnerable:

Drupal Maestro Module Mutiple Cross Site Scripting Vulnerabilities

The Maestro module for Drupal is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to execute arbitrary script code in the context of the vulnerable site, potentially allowing the attacker to steal cookie-based authentication credentials.

Maestro 7.x-1.x versions prior to 7.x-1.4 are vulnerable.

Drupal Maestro Module Mutiple Cross Site Scripting Vulnerabilities

Attackers can exploit these issues using browser. To exploit a cross-site scripting issue the attacker needs to entice a user into following a malicious URI.

Drupal Maestro Module Mutiple Cross Site Scripting Vulnerabilities

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Drupal Maestro Module Mutiple Cross Site Scripting Vulnerabilities

References:

• Drupal Homepage (Drupal)