Support for Drupal 7 is ending on 5 January 2025—it’s time to migrate to Drupal 10! Learn about the many benefits of Drupal 10 and find migration tools in our resource center.
By Drupal Security Team on
- Advisory ID: DRUPAL-SA-CONTRIB-2012-138
- Project: Exposed Filter Data (third-party module)
- Version: 6.x
- Date: 2012-September-05
- Security risk: Critical
- Exploitable from: Remote
- Vulnerability: Cross Site Scripting
Description
The Exposed Filter Data facilitates displaying data posted to Views via an exposed filter. The module does not properly sanitize user-supplied data prior to output, leading to a Cross-Site Scripting (XSS) vulnerability.
CVE: Requested
Versions affected
- Exposed Filter Data 6.x-1.x versions prior to 6.x-1.2.
Drupal core is not affected. If you do not use the contributed Exposed Filter Data module, there is nothing you need to do.
Solution
Install the latest version:
- If you use the Exposed Filter Data module for Drupal 6.x, upgrade to Exposed Filter Data 6.x-1.2.
- The 7.x-1.x branch is not vulnerable. If you use Exposed Filter Data for Drupal 7.x, there is nothing you need to do.
Also see the Exposed Filter Data project page.
Reported by
Fixed by
- Shushu Inbar, the module maintainer
Coordinated by
- Michael Hess (mlhess) of the Drupal Security Team
- Ivo Van Geertruyen (mr.baileys) of the Drupal Security Team
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.
Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.
