SA-CONTRIB-2012-033 - Read More Link - Cross Site Scripting

CVE: CVE-2012-1658

The Read More Link module allows you to move the “Read more” link from the node’s links area to the end of the teaser text.

A user could inject java script into pages affecting other site users. This vulnerability is mitigated by the fact that an attacker must have a role with the permission “access administration pages.”

Versions affected

• Read More Link 6.x-3.x versions prior to and including 6.x-3.0.

Drupal core is not affected. If you do not use the contributed Read More Link (Drupal 6 and earlier) module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Read More Link module for Drupal 6.x, upgrade to version 6.x-3.1 or 6.x-5.0

See also the Read More Link project page.

Reported by

• Kyle Small

Fixed by

• Stéphane Corlosquet
• Todd Nienkerk

Coordinated by

• Michael Hess of the Drupal Security Team