• Advisory ID: DRUPAL-SA-CONTRIB-2012-138
  • Project: Exposed Filter Data (third-party module)
  • Version: 6.x
  • Date: 2012-September-05
  • Security risk: Critical
  • Exploitable from: Remote
  • Vulnerability: Cross Site Scripting


The Exposed Filter Data facilitates displaying data posted to Views via an exposed filter. The module does not properly sanitize user-supplied data prior to output, leading to a Cross-Site Scripting (XSS) vulnerability.

CVE: Requested

Versions affected

  • Exposed Filter Data 6.x-1.x versions prior to 6.x-1.2.

Drupal core is not affected. If you do not use the contributed Exposed Filter Data module, there is nothing you need to do.


Install the latest version:

  • If you use the Exposed Filter Data module for Drupal 6.x, upgrade to Exposed Filter Data 6.x-1.2.
  • The 7.x-1.x branch is not vulnerable. If you use Exposed Filter Data for Drupal 7.x, there is nothing you need to do.

Also see the Exposed Filter Data project page.

Reported by

Fixed by

Coordinated by

  • Michael Hess (mlhess) of the Drupal Security Team
  • Ivo Van Geertruyen (mr.baileys) of the Drupal Security Team

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.