Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
securityvulnsSecurityvulnsSECURITYVULNS:DOC:17649
HistoryJul 31, 2007 - 12:00 a.m.

[DRUPAL-SA-2007-018] Drupal 4.7.7 and 5.2 fix multiple cross site scripting vulnerabilities

2007-07-3100:00:00
vulners.com
31
JSON

Drupal security advisory DRUPAL-SA-2007-018

Project: Drupal core
Version: 4.7.x, 5.x
Date: 2007-July-26
Security risk: Moderately critical
Exploitable from: Remote
Vulnerability: Multiple cross site scripting vulnerabilities

Description

Some server variables are not escaped consistently. When a malicious user is
able to entice a victim to visit a specially crafted link or webpage, arbitrary
HTML and script code can be injected and executed in the context of the
victim's session on the targeted website.

Custom content type names are not escaped consistently. A malicious user with
the 'administer content types' permission would be able to inject and execute
arbitrary HTML and script code on the website.
Revoking the 'administer content types' permission provides an immediate
workaround.

Both vulnerabilities are know as cross site scripting.

Versions affected

  • Drupal 4.7.x versions before Drupal 4.7.7
  • Drupal 5.x versions before Drupal 5.2

Solution

If you are unable to upgrade immediately, you can apply a patch to secure your
installation until you are able to do a proper upgrade.

Please note that the patches only contain changes related to this advisory, and
do not fix bugs that were solved in 4.7.7 or 5.2.

Important note

The configuration file settings.php is one of the files containing vulnerable
code. It is therefore critical to replace all of your sites' settings.php files
in subdirectories of sites with the new one from the archive. After you have
replaced the files, make sure to edit the value of the $db_url variable to be
identical to the value in your old settings.php. This is the information that
determines how Drupal connects to a database.

Reported by

  • The server variables issue was reported by David Caylor.
  • Content type naming issues were reported by Karthik.

Thanks

The security team whishes to thank Dave, Morten Wulff, Brenda Wallace,
Fernando Silva, Gerhard Killesreiter, Brandon Bergren, Bart Janssen and
Neil Drumm for technical assistance.

Contact

The security contact for Drupal can be reached at security at drupal.org or
using the form at http://drupal.org/contact.

JSON