Home / vulnerabilities Submenu Tree 6.x Cross Site Scripting
Posted on 01 March 2012
Source : packetstormsecurity.org Link
* Advisory ID: DRUPAL-SA-CONTRIB-2012-027
* Project: Submenu Tree [1] (third-party module)
* Version: 6.x
* Date: 2012-February-29
* Security risk: Moderately critical [2]
* Exploitable from: Remote
* Vulnerability: Cross Site Scripting
-------- DESCRIPTION
---------------------------------------------------------
The Submenu Tree module allows sufficiently privileged users to show a
list of menu entries when displaying a node.
The module does not sanitize some of the user-supplied data before
displaying it, leading to a Cross Site Scripting (XSS [3])
vulnerability.
The vulnerability is mitigated by the fact that a malicious user must
be assigned a role that includes permissions to edit the Drupal menus.
-------- VERSIONS AFFECTED
---------------------------------------------------
* Submenu Tree versions prior to 6.x-1.5
Drupal core is not affected. If you do not use the contributed Submenu Tree
[4] module,
there is nothing you need to do.
Drupal core is not affected. If you do not use the contributed Submenu Tree
[5] module, there is nothing you need to do.
-------- SOLUTION
------------------------------------------------------------
Install the latest version:
* If you use the Submenu Tree module upgrade to Submenu Tree 6.x-1.5 [6]
Please also see the
Submenu Tree project
page
.
See also the Submenu Tree [7] project page.
-------- REPORTED BY
---------------------------------------------------------
* Kyle Small
-------- FIXED BY
------------------------------------------------------------
* Beng Tan [8], module maintainer
-------- COORDINATED BY
------------------------------------------------------
* Michael Hess [9] of the Drupal Security Team
-------- CONTACT AND MORE INFORMATION
----------------------------------------
The Drupal security team can be reached at security at drupal.org or via the
contact form at http://drupal.org/contact [10].
Learn more about the Drupal Security team and their policies [11], writing
secure code for Drupal [12], and securing your site [13].
[1] http://drupal.org/project/submenutree
[2] http://drupal.org/security-team/risk-levels
[3] http://en.wikipedia.org/wiki/Cross-site_scripting
[4] http://drupal.org/project/submenutree
[5] http://drupal.org/project/submenutree
[6] http://drupal.org/node/1132838
[7] http://drupal.org/project/submenutree
[8] http://drupal.org/user/132729
[9] http://drupal.org/user/102818
[10] http://drupal.org/contact
[11] http://drupal.org/security-team
[12] http://drupal.org/writing-secure-code
[13] http://drupal.org/security/secure-configuration
