CVE-2010-1362

Vulnerability

The Own Term module for Drupal version 6.x-1.0 does not properly sanitize the term description field on a term listing page, leading to a cross-site scripting (XSS) vulnerability. The flaw exists in the module's handling of taxonomy terms within a designated vocabulary. [1]

Exploitation

An authenticated Drupal user with the 'create additional terms' permission can exploit this vulnerability by injecting arbitrary web script or HTML into the term description field. When a term listing page is rendered, the unsanitized input is executed in the context of other users' browsers. No other special network position or additional privileges are required beyond having the 'create additional terms' role. [1]

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the browser of any user viewing the affected term listing page. This can lead to session hijacking, defacement, or theft of sensitive data. The attacker must have an authenticated session with the required permission, but the impact is cross-site scripting (XSS) against other users. [1]

Mitigation

The vulnerability is fixed in Own Term version 6.x-1.1, released on 13 January 2010. Users should upgrade to this version immediately. Drupal core is not affected; only sites using the contributed Own Term module are at risk. No other workarounds are documented. [1][2]