Better Formats module (http://drupal.org/project/better_formats) contains a cross site scripting (XSS) vulnerability due to the fact that it fails to sanitize format names before display.

Mitigating factors:
-------------------
In order to execute arbitrary script injection malicious users must have 'Administer filters' permission. The Drupal security team has classified vulnerabilities that require this permission (http://drupal.org/node/475848) as "display bugs" because access to this permission allows for alteration of input specifications that could allow users with permissions to create content to craft arbitrary PHP.

The attached patch mitigates this "display bug"

CommentFileSizeAuthor
better_formats-6.x-1.2.patch859 bytesJustin_KleinKeane

Comments

dddave’s picture

dddave commented
Status: Active » Needs review
dragonwize’s picture

dragonwize commented
Status: Needs review » Fixed

Committed.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.