- Advisory ID: DRUPAL-SA-CONTRIB-2011-013
- Project: Tagadelic (third-party module)
- Version: 6.x
- Date: 2011-March-16
- Security risk: Moderately Critical (definition of risk levels)
- Exploitable from: Remote
- Vulnerability: Cross Site Scripting
Tagadelic module offers various ways to display terms and vocabularies in a tag cloud on a page or in a block. The module does not sanitize the taxonomy vocabulary names and descriptions when displayed on listing pages or blocks, leading to a Cross-Site Scripting (XSS) vulnerability that may lead to a malicious user gaining full administrative access.
This vulnerability is mitigated by the fact that the user must be able to create or edit taxonomy vocabularies, normally restricted by the "administer taxonomy" permission, in order to exploit it.
- Tagadelic module 6.x-1.x versions prior to 6.x-1.3
Note: If you do not use the contributed Tagadelic module, there is nothing you need to do.
Install the latest version:
- If you use the Tagadelic module for Drupal 6.x-1.x upgrade to Tagadelic 6.x-1.3
See also the Tagadelic project page.
- Greg Knaddison (greggles) of the Drupal Security Team
- Bèr Kessels, module maintainer
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via the form at http://drupal.org/contact. Learn more about the team and their policies, writing secure code for Drupal, and secure configuration of your site.