FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

drupal -- Multiple cross-site scripting vulnerabilities

Affected packages
drupal4 < 4.7.7
drupal5 < 5.2


VuXML ID 1f5b711b-3d0e-11dc-b3d3-0016179b2dd5
Discovery 2007-07-26
Entry 2007-07-28

The Drupal Project reports:

Some server variables are not escaped consistently. When a malicious user is able to entice a victim to visit a specially crafted link or webpage, arbitrary HTML and script code can be injected and executed in the context of the victim's session on the targeted website.

Custom content type names are not escaped consistently. A malicious user with the 'administer content types' permission would be able to inject and execute arbitrary HTML and script code on the website. Revoking the 'administer content types' permission provides an immediate workaround.