CVE-2010-1984

Vulnerability

The vulnerability exists in the Taxonomy Breadcrumb module for Drupal, versions 5.x before 5.x-1.5 and 6.x before 6.x-1.1. The module does not properly sanitize taxonomy term names (and node titles in 6.x) when displaying them in breadcrumbs, allowing a stored cross-site scripting (XSS) attack. To exploit, an attacker must have the 'administer taxonomy' permission, as the malicious payload is inserted into the term name via the taxonomy administration interface [2].

Exploitation

An attacker with the 'administer taxonomy' permission creates or edits a taxonomy term with a crafted term name containing malicious JavaScript. When any user (including administrators) visits a page that displays breadcrumbs using that term, the script executes in the browser. This can occur on node pages or taxonomy/term pages. No additional user interaction beyond normal browsing is required [2].

Impact

Successful exploitation allows arbitrary web script or HTML to execute in the victim's browser session. This can lead to compromise of administrative accounts, theft of session cookies, defacement, or other attacks against site visitors. The Drupal Security Team rated this as a critical risk [2].

Mitigation

The official fix was released on 2010-03-31. Users of the 5.x branch should upgrade to 5.x-1.5 [1], and users of the 6.x branch should upgrade to 6.x-1.1 [3]. No workarounds are provided; upgrading the module is the only solution.