Drupal Nodequeue Module Security Bypass and Cross Site Scripting Vulnerabilities

The Drupal Nodequeue module is prone to a security-bypass and a cross-site scripting vulnerability because it fails to properly validate user credentials and sanitize user-supplied input.

An attacker may leverage the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

The attacker may leverage the security-bypass issue to view or modify data, despite the attacker's insufficient privileges.

The following are affected:

Nodequeue for Drupal 5.x prior to 5.x-2.7
Nodequeue for Drupal 6.x prior to 6.x-2.2


Privacy Statement
Copyright 2010, SecurityFocus