Drupal Nodequeue Module Security Bypass and Cross Site Scripting Vulnerabilities
The Drupal Nodequeue module is prone to a security-bypass and a cross-site scripting vulnerability because it fails to properly validate user credentials and sanitize user-supplied input.
An attacker may leverage the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
The attacker may leverage the security-bypass issue to view or modify data, despite the attacker's insufficient privileges.
The following are affected:
Nodequeue for Drupal 5.x prior to 5.x-2.7
Nodequeue for Drupal 6.x prior to 6.x-2.2