----------------------------------------------------------------------

Did you know that a change in our assessment rating, exploit code
availability, or if an updated patch is released by the vendor, is
not part of this mailing-list?

Click here to learn more:
http://secunia.com/advisories/business_solutions/

----------------------------------------------------------------------

TITLE:
Drupal Project Issue Tracking Module Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA33439

VERIFY ADVISORY:
http://secunia.com/advisories/33439/

CRITICAL:
Less critical

IMPACT:
Cross Site Scripting, Exposure of sensitive information

WHERE:
>From remote

SOFTWARE:
Drupal Project issue tracking Module 5.x
http://secunia.com/advisories/product/15377/

DESCRIPTION:
A security issue and a vulnerability have been reported in the
Project Issue Tracking module for Drupal, which can be exploited by
malicious users to disclose sensitive information or conduct script
insertion attacks.

1) A security issue is caused due to an unspecified error, which can
lead to users receiving e-mail updates for issues they do not have
sufficient access rights to, potentially disclosing sensitive
information. No further information is currently available.

2) Input passed to unspecified parameters is not properly sanitised
before being used. This can be exploited to insert arbitrary HTML and
script code, which will be executed in a user's browser session in the
context of an affected site when the malicious status values are
viewed.

Successful exploitation of this vulnerability requires the
"administer projects" permission.

NOTE: This has a security impact if a role separation between
administrators and users with the "administer projects" permission
exists.

SOLUTION:
Update to version 5.x-2.3.

PROVIDED AND/OR DISCOVERED BY:
1) Damien Tournoud, Drupal Security team.
2) Derek Wright, Drupal Security team.

ORIGINAL ADVISORY:
DRUPAL-SA-CONTRIB-2009-002:
http://drupal.org/node/355673

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/advisories/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/advisories/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------

Unsubscribe: Secunia Security Advisories
http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

----------------------------------------------------------------------