Info

Disclosure

Aug 10, 2012

Discovery

Unknown

Dates

Exploit

Unknown

Solution

Aug 10, 2012

Description

Elegant Theme for Drupal contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate input passed via the 3 slide gallery before returning it to the user. This may allow a user to create a specially crafted request that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

Classification

Location: Remote / Network Access
Attack Type: Input Manipulation
Impact: Loss of Integrity
Solution: Upgrade
Exploit: Exploit Private
Disclosure: Vendor Verified, Coordinated Disclosure
OSVDB: Authentication Required, Web Related

Solution

Upgrade to version 7.x-1.1 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

Products

Pradeep Saran

Elegant Theme for Drupal

7.x-1.0

References

CVE ID: 2012-4497 (see also: NVD)
Secunia Advisory ID: 50273
Bugtraq ID: 55043
Vendor Specific News/Changelog Entry: http://drupal.org/node/1722880
Vendor Specific Advisory URL: http://drupal.org/node/1733056
Other Advisory URL: http://www.openwall.com/lists/oss-security/2012/10/04/6
http://www.openwall.com/lists/oss-security/2012/10/07/1

Credit

Unknown or Incomplete

Direct URL: http://osvdb.org/84748