CVE-2010-1976

Vulnerability

The Taxonomy Breadcrumb module versions 6.x before 6.x-1.1 and 5.x before 5.x-1.5 for Drupal contain a stored cross-site scripting (XSS) vulnerability. The module does not properly sanitize the node title when generating breadcrumbs on node pages [1][2]. For the 6.x branch, the vulnerable field is the node title, which is displayed in breadcrumbs without escaping [2]. The vulnerability is exploitable by remote authenticated users who possess the "administer taxonomy" permission [description].

Exploitation

An attacker must be a remote authenticated user with the permission to administer taxonomy [description]. The attacker creates or modifies a node with a crafted title containing arbitrary web script or HTML. When the node is viewed and the Taxonomy Breadcrumb module renders the breadcrumb, the injected script executes in the context of the victim's browser [2][3].

Impact

Successful exploitation allows an attacker to inject arbitrary web script or HTML into pages viewed by other site users [description][2]. This can lead to compromise of administrative accounts, theft of sensitive information, or other attacks against site visitors [2].

Mitigation

Users of the 6.x-1.x branch should upgrade to version 6.x-1.1, and users of the 5.x-1.x branch should upgrade to version 5.x-1.5, both released on 31 March 2010 [2][3]. No other mitigation is necessary for sites that do not use the Taxonomy Breadcrumb module [2].