By Drupal Security Team on
  • Advisory ID: DRUPAL-SA-CONTRIB-2010-031
  • Project: Menu Block (third-party module)
  • Versions: 6.x-2.x, 5.x-2.x, 5.x-1.x
  • Date: 2010-March-24
  • Security risk: Less Critical
  • Exploitable from: Remote
  • Vulnerability: Cross Site Scripting

Description

The Menu Block module generates full or partial menu trees that are presented in configurable blocks. When partial menu trees are displayed, the block title uses the text from the partial menu tree's parent menu item. However, that text is not properly sanitized, leading to a Cross Site Scripting (XSS) vulnerability. XSS vulnerabilities may expose site administrative accounts which could lead to a variety of additional compromises. This vulnerability is mitigated by the fact that an attacker must have the "administer menu" permission which should generally only be granted to trusted roles.

Versions affected

  • Menu Block module for Drupal 6.x version prior to 6.x-2.3.
  • Menu Block module for Drupal 5.x versions prior to 5.x-2.1 or 5.x-1.1.

Drupal core is not affected. If you do not use the contributed Menu Block module, there is nothing you need to do.

Solution

Install the latest version.

Reported by

Fixed by

Contact

The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact.

⋅ Categories: Drupal 5.x, Drupal 6.x