drupal-pathauto

Page content
  • Author: Miklos Vajna
  • Vulnerable: 5.x_2.3-1
  • Unaffected: 5.x_2.4-1locris1

Some vulnerabilities have been reported in the Pathauto module for Drupal, which can be exploited by malicious users to conduct script insertion attacks. Input passed via the “[bookpathalias]”, “[catalias]”, and “[termalias]” tokens is not properly sanitised before being displayed to the user. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user’s browser session in context of an affected site when the malicious data is being viewed. Successful exploitation requires “create url aliases” permissions and that the tokens are used in an HTML page e.g. when displaying a message using an action from the token_actions.module.

CVEs: