CVE-2012-5585

Affected software: Drupal Mixpanel contributed module (6.x-1.x) prior to 6.x-1.1. Vulnerability: Cross-site scripting (XSS) due to insufficient escaping of the Mixpanel token when injecting the tracking Javascript. Prereq/impact: Requires a user with the “access administration pages” permission; ...

SA-CONTRIB-2012-167 - Mixpanel - Cross site scripting (XSS)

This module provides integration with the Mixpanel real-time analytics service. The module doesn't sufficiently escape the Mixpanel token when adding the tracking Javascript to the page. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access...