Repeatable: Always
Steps to repeat:
1. Download Module FAQ
2. Un-compress foo-6.x-x.x-tar.gz into modules folder
3. Visit admin/modules page in site and enable faq module
4. Go to node/add/faq

Give

alert(123);

as title and description
Save content. It will get added without any issue.
Go to Frequently Asked Questions link -- faq
Javascript will get executed.
This makes it vulnerable to XSS attacks

Could you fix this, please?

Comments

stella’s picture

stella commented
Status: Active » Fixed

SA released http://drupal.org/node/1451194

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

drumm’s picture

drumm
he/him
Location NY, US
commented
Issue summary: View changes

Publishing since the advisory was released.

Please report potential security issues confidentially in the future.