drupal-date: cross site scripting
| Package(s): | drupal-date |
CVE #(s): | |
| Created: | July 31, 2009 |
Updated: | September 21, 2009 |
| Description: |
From the Fedora advisory: The Date module provides a date CCK field that
can be added to any content type. The Date Tools module that is bundled
with Date module does not properly escape user input when displaying
labels for fields on a content type. A malicious user with the 'use date
tools' permission of the Date Tools sub-module, or the 'administer content
types' permission could attempt a cross site scripting [1] (XSS) attack
when creating a new content type, leading to the user gaining full
administrative access. |
| Alerts: |
|
