[Security-news] SA-CONTRIB-2010-010 - Author Contact - Cross site scripting
securi...@drupal.org
* Project: Author Contact (third-party module)
* Version: 5.x, 6.x
* Date: 2010-January-27
* Security risk: Less critical
* Exploitable from: Remote
* Vulnerability: Cross Site Scripting
-------- DESCRIPTION
---------------------------------------------------------
The Author Contact module provides a form to contact the author of the
current post. The module does not properly sanitize parts of the provided
block, leading to a cross-site scripting (XSS [1]) vulnerability. Such an
attack may lead to a malicious user gaining full administrative access. A
user must have a role with the permission /administer blocks/ to exploit.
-------- VERSIONS AFFECTED
---------------------------------------------------
* Author Contact for Drupal 6.x prior to 6.x-1.3
* Author Contact for Drupal 5.x prior to 5.x-1.3
Drupal core is not affected. If you do not use the contributed Author Contact
module, there is nothing you need to do.
-------- SOLUTION
------------------------------------------------------------
Upgrade to the latest version:
* If you use Author Contact for Drupal 6.x upgrade to Author Contact 6.x-1.3
[2]
* If you use Author Contact for Drupal 5.x upgrade to Author Contact 5.x-1.3
[3]
See also the Author Contact project page [4].
-------- REPORTED BY
---------------------------------------------------------
* mr.baileys [5]
-------- FIXED BY
------------------------------------------------------------
* James Crook [6], the module maintainer
* Benjamin Jeavons [7]
-------- CONTACT
-------------------------------------------------------------
The security contact for Drupal can be reached at security at drupal.org or
via the form at http://drupal.org/contact.
[1] http://en.wikipedia.org/wiki/Cross-site_scripting
[2] http://drupal.org/node/694238
[3] http://drupal.org/node/693896
[4] http://drupal.org/project/authorcontact
[5] http://drupal.org/user/383424
[6] http://drupal.org/user/204495
[7] http://drupal.org/user/91990
_______________________________________________
Security-news mailing list
Securi...@drupal.org
http://lists.drupal.org/mailman/listinfo/security-news