- Advisory ID: DRUPAL-SA-CONTRIB-2009-112
- Project: Sections (third-party module)
- Version: 5.x, 6.x
- Date: 2009-December-16
- Security risk: Moderately Critical
- Exploitable from: Remote
- Vulnerability: Cross Site Scripting
Description
The Sections module allows the creation of sections within a site. Each section has an installed template, theme or style attached to it. The module does not sanitize some of the user-supplied data before displaying it, leading to a Cross Site Scripting (XSS) vulnerability. Users who can take advantage of this vulnerability could gain administrator access to a site. This vulnerability is mitigated by the fact that the attacker must have a role with the 'administer sections' permission.
Versions affected
- Sections module 5.x-1.2 and prior versions
- Sections module 6.x-1.2 and prior versions
Drupal core is not affected. If you do not use the contributed Sections module, there is nothing you need to do.
Solution
Install the latest version:
- If you use the Sections module for Drupal 5.x upgrade to Sections 5.x-1.3
- If you use the Sections module for Drupal 6.x upgrade to Sections 6.x-1.3
See also the Sections module project page
Reported by
Fixed by
Alexander Hass the module maintainer.
Contact
The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact.
