Drupal Association members fund grants that make connections all over the world.
- Advisory ID: DRUPAL-SA-CONTRIB-2012-138
- Project: Exposed Filter Data (third-party module)
- Version: 6.x
- Date: 2012-September-05
- Security risk: Critical
- Exploitable from: Remote
- Vulnerability: Cross Site Scripting
The Exposed Filter Data facilitates displaying data posted to Views via an exposed filter. The module does not properly sanitize user-supplied data prior to output, leading to a Cross-Site Scripting (XSS) vulnerability.
- Exposed Filter Data 6.x-1.x versions prior to 6.x-1.2.
Drupal core is not affected. If you do not use the contributed Exposed Filter Data module, there is nothing you need to do.
Install the latest version:
- If you use the Exposed Filter Data module for Drupal 6.x, upgrade to Exposed Filter Data 6.x-1.2.
- The 7.x-1.x branch is not vulnerable. If you use Exposed Filter Data for Drupal 7.x, there is nothing you need to do.
Also see the Exposed Filter Data project page.
- Shushu Inbar, the module maintainer
- Michael Hess (mlhess) of the Drupal Security Team
- Ivo Van Geertruyen (mr.baileys) of the Drupal Security Team
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.