Date: Tue, 28 Dec 2010 00:24:31 +0300 (MSK) From: Eygene Ryabinkin <rea@FreeBSD.org> To: FreeBSD-gnats-submit@FreeBSD.org Subject: ports/153474: [VuXML] security/vuxml: document XSS in www/drupal6-views Message-ID: <20101227212431.5554CDA81F@void.codelabs.ru> Resent-Message-ID: <201012272130.oBRLUBla031006@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 153474 >Category: ports >Synopsis: [VuXML] security/vuxml: document XSS in www/drupal6-views >Confidential: no >Severity: serious >Priority: medium >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Mon Dec 27 21:30:11 UTC 2010 >Closed-Date: >Last-Modified: >Originator: Eygene Ryabinkin >Release: FreeBSD 9.0-CURRENT amd64 >Organization: Code Labs >Environment: System: FreeBSD 9.0-CURRENT amd64 >Description: Cross-site scripting vulnerability was found in Drupal-6.x views plugin: [1]. >How-To-Repeat: [1] http://drupal.org/node/999380 >Fix: The following VuXML entry should be evaluated and added: --- vuln.xml begins here --- <vuln vid="ff8b419a-0ffa-11e0-becc-0022156e8794"> <topic>Drupal Views plugin -- cross-site scripting</topic> <affects> <package> <name>drupal6-views</name> <range><lt>2.12</lt></range> </package> </affects> <description> <body xmlns="http://www.w3.org/1999/xhtml">; <p>Drupal security team reports:</p> <blockquote cite="http://drupal.org/node/999380">; <p>The Views module provides a flexible method for Drupal site designers to control how lists and tables of content are presented. Under certain circumstances, Views could display parts of the page path without escaping, resulting in a relected Cross Site Scripting (XSS) vulnerability. An attacker could exploit this to gain full administrative access.</p> <p>Mitigating factors: This vulnerability only occurs with a specific combination of configuration options for a specific View, but this combination is used in the default Views provided by some additional modules. A malicious user would need to get an authenticated administrative user to visit a specially crafted URL.</p> </blockquote> </body> </description> <references> <cvename>CVE-2010-4521</cvename> <url>http://drupal.org/node/999380</url>; </references> <dates> <discovery>2010-12-15</discovery> <entry>TODAY</entry> </dates> </vuln> --- vuln.xml ends here --- Port upgrade to 2.12 is on the go (I am the maintainer). >Release-Note: >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20101227212431.5554CDA81F>