Drupal Gallery Formatter Module Unspecified HTML Injection Vulnerability Updated
29 Nov. 2012
Summary
The Gallery formatter module for Drupal is prone to an unspecified HTML-injection vulnerability because it fails to properly sanitize user-supplied input.
Credit:
The information has been provided by Sudipta Bandyopadhyay.
The original article can be found at: http://drupal.org/node/1700578
CVE-2012-4485:Gallery formatter provides a field formatter for images that turns the fields into jQuery galleries.The module did not properly escape input from the user before printing it to the browser, allowing malicious users to inject script code into the page.This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create the nodes / entities and the fields that use the formatter.
