Description
Cross-site scripting (XSS) vulnerability in the taxonomy module in Drupal 4.6.8 and 4.7.2 allows remote attackers to inject arbitrary web script or HTML via inputs that are not properly validated when the page title is output, possibly involving the $names variable.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.1 | drupal | 4.5.3-6.1sarge1 | DSA-1125 |
Advisories 1
- DSA-1125 drupal - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- 20412 third-party-advisory
- 1041 third-party-advisory
- http://drupal.org/node/66767
- 18245 vdb-entry
- drupal-taxonomy-xss(26893) vdb-entry
- DSA-1125 vendor-advisory
- ADV-2006-2112 vdb-entry
- 21244 third-party-advisory
- 20060602 [DRUPAL-SA-2006-008] Drupal 4.6.8 / 4.7.2 fixes XSS issue mailing-list
- http://drupal.org/files/sa-2006-008/4.6.7.patch