drupal6-img_assist
Page content
- Author: Miklos Vajna
- Vulnerable: 6.x_1.0-1
- Unaffected: 6.x_1.1-1anacreon1
Some vulnerabilities have been reported in the Image Assist module for Drupal, which can be exploited by malicious users to conduct script insertion attacks or to disclose potentially sensitive information.
- Input passed to the node title is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user’s browser session in context of an affected site when the malicious data is viewed.
- Certain pages do not properly check the required access permissions, which can be exploited to view the title and body of arbitrary nodes.
- Bug Tracker URL: http://bugs.frugalware.org/task/3876
CVEs:
- No CVE references, see http://drupal.org/node/520564