Rotor CVE-2010-2125 Cross-Site Scripting Vulnerability

Bugtraq ID:	73732
Class:	Input Validation Error
CVE:	CVE-2010-2125
Remote:	Yes
Local:	No
Published:	Jun 01 2010 12:00AM
Updated:	Jun 01 2010 12:00AM
Credit:	Unknown
Vulnerable:	Systemseed Rotor 6.X-2.X Dev Systemseed Rotor 6.X-2.4 Systemseed Rotor 6.X-2.3 Systemseed Rotor 6.X-2.2 Systemseed Rotor 6.X-2.1 Systemseed Rotor 6.X-2.0 Rc1 Systemseed Rotor 6.X-2.0 Beta3 Systemseed Rotor 6.X-2.0 Beta2 Systemseed Rotor 6.X-2.0 Beta1 Systemseed Rotor 6.x-2.0 Systemseed Rotor 6.X-1.X Dev Systemseed Rotor 6.x-1.4 Systemseed Rotor 6.x-1.3 Systemseed Rotor 6.X-1.2 Systemseed Rotor 6.x-1.1 Systemseed Rotor 6.X-1.0 Systemseed Rotor 5.X-1.X Dev Systemseed Rotor 5.X-1.7 Systemseed Rotor 5.x-1.6 Systemseed Rotor 5.x-1.5 Systemseed Rotor 5.x-1.4 Systemseed Rotor 5.X-1.3 Systemseed Rotor 5.X-1.2 Systemseed Rotor 5.X-1.1 Systemseed Rotor 5.x-1.0
Not Vulnerable:

Rotor CVE-2010-2125 Cross-Site Scripting Vulnerability

Rotor is prone to a cross-site scripting vulnerability. Multiple cross-site scripting (XSS) vulnerabilities in the Rotor Banner module 5.x before 5.x-1.8 and 6.x before 6.x-2.5 for Drupal allow remote authenticated users, with "create rotor item" or "edit any rotor item" privileges, to inject arbitrary web script or HTML via the (1) srs, (2) title, or (3) alt image attribute.

Rotor CVE-2010-2125 Cross-Site Scripting Vulnerability

An attacker can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

Rotor CVE-2010-2125 Cross-Site Scripting Vulnerability

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or you are aware of more recent information, please mail us at: [email protected]

Rotor CVE-2010-2125 Cross-Site Scripting Vulnerability

References:

• IBM X-Force Exchange Beta (XF)
  
• SA-CONTRIB-2010-057 - Rotor Banner - Cross Site Scripting (XSS) (Drupal)