4.3 Medium
CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
NONE
Availability Impact
NONE
AV:N/AC:M/Au:N/C:P/I:N/A:N
0.002 Low
EPSS
Percentile
61.8%
This module enables you to assign meta tags on Drupal 6 sites to aid with 3rd party search indexing and sharing on social networks.
The module doesn’t correctly filter node content when configured to automatically generate descriptions meta tags from the node text. This lack of filtering could allow some code, e.g. BBCode, to pass through unprocessed and potentially display private or otherwise secret information, links, file paths or other potentially sensitive details. The problem affects the normal ‘description’ meta tag along with the ‘dc.description’ and ‘og:description’ meta tags, all of which used the same logic.
This vulnerability is mitigated by the fact that it is unlikely that sensitive content would be within the extracted portion.
Drupal core is not affected. If you do not use the contributed Nodewords: D6 Meta Tags module, there is nothing you need to do.
Install the latest version:
Also see the Nodewords: D6 Meta Tags project page.
drupal.org/contact
drupal.org/node/1859208
drupal.org/project/nodewords
drupal.org/security-team
drupal.org/security-team/risk-levels
drupal.org/security/secure-configuration
drupal.org/user/108450
drupal.org/user/169459
drupal.org/user/347249
drupal.org/user/36762
drupal.org/user/37833
drupal.org/writing-secure-code