Description
The Drupal.checkPlain function in Drupal 6.0 only escapes the first instance of a character in ECMAScript, which allows remote attackers to conduct cross-site scripting (XSS) attacks.
References
- http://drupal.org/node/227608
- 29118 third-party-advisory
- 28026 vdb-entry