Drupal Web Links Module Cross Site Scripting Vulnerability

Bugtraq ID:	74763
Class:	Input Validation Error
CVE:	CVE-2015-5497
Remote:	Yes
Local:	No
Published:	May 20 2015 12:00AM
Updated:	Nov 03 2015 07:04PM
Credit:	Jonathan Smith
Vulnerable:	Drupal Web Links 7.x-1.0-alpha2 Drupal Web Links 7.x-1.0-alpha1 Drupal Web Links 6.x-2.5 Drupal Web Links 6.x-2.4 Drupal Web Links 6.x-2.3 Drupal Web Links 6.x-2.2 Drupal Web Links 6.x-2.1 Drupal Web Links 6.x-2.0
Not Vulnerable:	Drupal Web Links 7.x-1.0 Drupal Web Links 6.x-2.6

Drupal Web Links Module Cross Site Scripting Vulnerability

The Web Links module for Drupal is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

The following versions are vulnerable:

Web Links 6.x-2.x versions prior to 6.x-2.6
Web Links 7.x-1.x versions prior to 7.x-1.0

Drupal Web Links Module Cross Site Scripting Vulnerability

Attackers can exploit this issue by enticing an unsuspecting victim to follow a malicious URI.

Drupal Web Links Module Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.