SA-CONTRIB-2012-015 - Managesite - Cross Site Scripting (XSS)

CVE: CVE-2012-1640

This module provides a way to build a control panel similar to the one provided by Drupal 7 on the admin zone (/admin). The module doesn’t sufficiently filter user supplied text in the administration settings. This vulnerability is mitigated by the fact that an attacker must have a role with the permission “administer managesite”.

Versions affected

• Managesite 6.x-1.x versions prior to 6.x-1.1.

Drupal core is not affected. If you do not use the contributed Managesite module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Managesite module for Drupal 6.x, upgrade to Managesite 6.x-1.1

See also the Managesite project page.

Reported by

• Justin Klein Keane

Fixed by

• jacinto capote robles the module maintainer

Coordinated by

• Greg Knaddison of the Drupal Security Team