- Advisory ID: DRUPAL-SA-CONTRIB-2012-033
- Project: Read More Link (third-party module)
- Version: 6.x
- Date: 2012-March-07
- Security risk: Moderately critical
- Exploitable from: Remote
- Vulnerability: Cross Site Scripting
The Read More Link module allows you to move the "Read more" link from the node's links area to the end of the teaser text.
A user could inject java script into pages affecting other site users. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access administration pages."
- Read More Link 6.x-3.x versions prior to and including 6.x-3.0.
Drupal core is not affected. If you do not use the contributed Read More Link (Drupal 6 and earlier) module, there is nothing you need to do.
Install the latest version:
See also the Read More Link project page.
- Michael Hess of the Drupal Security Team
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.