|
Description
|
|
Justin C. Klein Keane has reported two vulnerabilities in the HotBlocks module for Drupal, which can be exploited by malicious users to conduct script insertion attacks and cause a DoS (Denial of Service).
1) Certain input related to "block names" is not properly sanitised before being used. This can be exploited to insert arbitrary HTML and script code, which will be executed in a user's browser session in context of an affected site when the malicious data is being viewed.
2) An error when handling hotblocks recursively embedded in other hotblocks can be exploited to cause a infinite loop and render the site unusable.
Successful exploitation of the vulnerabilities requires the "administer hotblocks" permission.
The vulnerabilities are reported in versions prior to 6.x-1.8.
|
