Voting starts in March for the Drupal Association Board election.
- Advisory ID: DRUPAL-SA-CONTRIB-2009-114
- Project: Automated Logout (third-party module)
- Version: 6.x
- Date: 2009-December-23
- Security risk: Moderately Critical
- Exploitable from: Remote
- Vulnerability: Cross Site Scripting
This module provides a site administrator the ability to log users out after a specified time of inactivity. The module does not sanitize some of the user-supplied data before displaying it, leading to a cross-site scripting (XSS) vulnerability. Users who can take advantage of this vulnerability could gain administrator access to a site. This vulnerability is mitigated by the fact that the attacker must have a role with the 'administer autologout' permission.
- Automated Logout module 6.x-1.6 and prior versions on the 6.x-1.x branch
- Automated Logout module 6.x-2.2 and prior versions on the 6.x-2.x branch
Note that the Drupal 5 version of the Automated Logout module is also affected, but the attacker must have a role with the 'administer site configuration' permission. The 'administer site configuration' permission is inherently unsafe and should only be granted to trusted users; therefore, this issue is not considered a security vulnerability for Drupal 5 (see http://drupal.org/node/475848).
Drupal core is not affected. If you do not use the contributed Automated Logout module, there is nothing you need to do.
Install the latest version:
- If you use the Automated Logout module for Drupal 6.x, upgrade to either Automated Logout 6.x-1.7 or Automated Logout 6.x-2.3
See also the Automated Logout module project page.
jvandervort, one of the Automated Logout module maintainers
The security team for Drupal can be reached at security at drupal.org or via the form at http://drupal.org/contact.