SA-CONTRIB-2012-005 - Vote up/down - Cross Site Scripting

CVE: CVE-2012-1627

This module enables you to add voting widgets to nodes, terms and comments.
The vud_term sub-module doesn’t sufficiently sanitize taxonomy terms before display.
In order to execute arbitrary script injection malicious users must have the ability to create or edit taxonomy terms.

Versions affected

• Vote up/down 6.x-2.x versions prior to 6.x-2.8.
• Vote up/down 6.x-3.x versions prior to 6.x-3.1.

Drupal core is not affected. If you do not use the contributed Vote Up/Down module, there is nothing you need to do.

Solution

Install the latest version:

• If you use a 6.x-2.x version of Vote up/down module for Drupal 6.x, upgrade to Vote up/down 6.x-2.8.
• If you use a 6.x-3.x version of Vote up/down module for Drupal 6.x, upgrade to Vote up/down 6.x-3.1.

See also the Vote Up/Down project page.

Reported by

• Justin C. Klein Keane

Fixed by

• Marco Villegas the module maintainer
• Greg Knaddison of the Drupal Security Team

Coordinated by

• Greg Knaddison, Drupal security team member