Ceci est la liste des annonces de sécurité qui ont été faites pour la version stable actuelle de Frugalware
| Paquet: | drupal-simplenews |
| Date: | 2008-09-26 |
| Posté par: | Miklos Vajna |
| Version vulnérable: | 5.x_1.4-1 |
| Version non affectée: | 5.x_1.5-1solaria1 |
| Entrée de suivi des bugs: | http://bugs.frugalware.org/task/3362 |
| CVEs: | There is no CVE for this issue yet, see http://drupal.org/node/312944. |
| Description: | A vulnerability has been reported in the Simplenews module for Drupal, which can be exploited by malicious users to conduct script insertion attacks. Input passed as Newsletter categories is not properly sanitised before being stored. This can be exploited to insert arbitrary HTML and script code, which is executed in a user's browser session in context of an affected site when the malicious data is viewed. Successful exploitation requires valid user credentials with the "administer taxonomy" permission. |