SA-CONTRIB-2012-002 - Lingotek - Cross Site Scripting

CVE: CVE-2012-1624

This module enables you to translate a website’s content using tools provided by the Lingotek Collaborative Translation Network.

The module doesn’t sufficiently sanitize user input when creating or editing page content. This allows a malicious content editor to potentially input malicious code (e.g. Javascript) to create a persistent Cross Site Scripting (XSS) attack.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission to edit or create node content types.

Versions affected

• Lingotek 6.x-1.x versions prior to 6.x-1.4 6.x-1.40.

Drupal core is not affected. If you do not use the contributed Lingotek Collaborative Translation module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Lingotek module for Drupal 6.x, upgrade to Lingotek 6.x-1.4 Lingotek 6.x-1.40.

See also the Lingotek Collaborative Translation project page.

Reported by

• Ezra Barnett Gildesgame

Fixed by

• Steven Blatnick the module maintainer

Coordinated by

• Forest Monsen of the Drupal Security Team