By Drupal Security Team on
  • Advisory ID: DRUPAL-SA-CONTRIB-2009-096
  • Project: Link (third-party module)
  • Version: 5.x, 6.x
  • Date: 2009-November-4
  • Security risk: Moderately Critical
  • Exploitable from: Remote
  • Vulnerability: Cross Site Scripting

Description

The Link module provides a CCK field which enables links to be added to content types, that can include a URL, title, and target attribute.

When using the "Separate title and URL" formatter supplied by the module, the link title field is not sanitized before being displayed, leading to a Cross Site Scripting (XSS) vulnerability.

Versions affected

Drupal core is not affected. If you do not use the contributed Link module, there is nothing you need to do.

Solution

Upgrade to the latest version:

  • If you use Link module for Drupal 6.x upgrade to version 6.x-2.7
  • If you use Link module for Drupal 5.x upgrade to version 5.x-2.6

Reported by

Fixed by

Contact

The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact.