• Advisory ID: DRUPAL-SA-CONTRIB-2009-112
  • Project: Sections (third-party module)
  • Version: 5.x, 6.x
  • Date: 2009-December-16
  • Security risk: Moderately Critical
  • Exploitable from: Remote
  • Vulnerability: Cross Site Scripting

Description

The Sections module allows the creation of sections within a site. Each section has an installed template, theme or style attached to it. The module does not sanitize some of the user-supplied data before displaying it, leading to a Cross Site Scripting (XSS) vulnerability. Users who can take advantage of this vulnerability could gain administrator access to a site. This vulnerability is mitigated by the fact that the attacker must have a role with the 'administer sections' permission.

Versions affected

  • Sections module 5.x-1.2 and prior versions
  • Sections module 6.x-1.2 and prior versions

Drupal core is not affected. If you do not use the contributed Sections module, there is nothing you need to do.

Solution

Install the latest version:

See also the Sections module project page

Reported by

Justin C. Klein Keane

Fixed by

Alexander Hass the module maintainer.

Contact

The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact.