SA-CONTRIB-2012-145 - Imagemenu - Cross Site Scripting (XSS)

Imagemenu module allows you to create Drupal menus from images files.

The module doesn’t sufficiently escape image file names when rendering menus, allowing a potential XSS attack.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission “administer imagemenu”.

CVE: CVE-2012-6583

Versions affected

• Imagemenu 6.x-1.x versions prior to 6.x-1.4.

Drupal core is not affected. If you do not use the contributed Imagemenu module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Imagemenu module for Drupal 6.x, upgrade to Imagemenu 6.x-1.4

Also see the Imagemenu project page.

Reported by

• David Houlder

Fixed by

• Paul Maddern, module maintainer
• Marcus Clements, module maintainer
• Ben Jeavons of the Drupal Security Team

Coordinated by

• Michael Hess, Ben Jeavons, and Greg Knaddison of the Drupal Security Team