drupal-simplenews
Page content
- Author: Miklos Vajna
- Vulnerable: 5.x_1.4-1
- Unaffected: 5.x_1.5-1solaria1
A vulnerability has been reported in the Simplenews module for Drupal, which can be exploited by malicious users to conduct script insertion attacks. Input passed as Newsletter categories is not properly sanitised before being stored. This can be exploited to insert arbitrary HTML and script code, which is executed in a user’s browser session in context of an affected site when the malicious data is viewed. Successful exploitation requires valid user credentials with the “administer taxonomy” permission.
- Bug Tracker URL: http://bugs.frugalware.org/task/3362
CVEs:
- There is no CVE for this issue yet, see http://drupal.org/node/312944.