# MA-172.072009: MyCERT Alert - Multiple Vulnerabilities in Drupal

**Date:** 05 Jul 2009  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-172.072009  
**Advisory ID:** MA-172.072009

---

#### **1.0 Introduction**
Several vulnerabilities have been identified in Drupal, a free and open source content management system that allows an individual or a community of users to easily publish, manage and organize a wide variety of content on a website. The vulnerabilities are as the following:
- Cross-Site Scripting
- Code Injection
- Information Disclosure Vulnerabilities
**2.0 Impact**
By exploiting these vulnerabilities, an attacker could potentially obtain sensitive information, execute arbitrary code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, or control how the site is rendered to the user. In certain situations, it may also be possible for attacker to execute arbitrary code on the affected server.
**3.0 Affected Products**
Below is the details list of vulnerable version:
- For Drupal 5.x: Drupal 5.18 and earlier version
- For Drupal 6.x: Drupal 6.12 and earlier version
**4.0 Recommendation**
MyCERT highly recommends that users of this application upgrade to the latest version of Drupal. The latest version  can be obtained via this URL: <http://drupal.org/project/drupal> 
Alternatively, users can apply the official patches provided by Drupal to fix the vulnerabilities if they are  unable to do a proper upgrade. These patches fix the security vulnerabilities mentioned above, but do not contain other fixes which were released in Drupal 5.19 or Drupal 6.13.
- To patch Drupal 6.12 use <http://drupal.org/files/sa-core-2009-007/SA-CORE-2009-007-6.12.patch>
- To patch Drupal 5.18 use <http://drupal.org/files/sa-core-2009-007/SA-CORE-2009-007-5.18.patch>
**MyCERT can be reached at:**
E-mail : [[email protected]](/cdn-cgi/l/email-protection#74170d1611064d4d4d34170d16110607111701061d000d5a190d) or [[email protected]](/cdn-cgi/l/email-protection#85e8fce6e0f7f1c5e8fce6e0f7f1abeaf7e2abe8fc)
Phone : +603 89926969 + nomboer 1-300-\* (monitored during business hours)
Fax : +603 89453442
Handphone : +60 19 2665850 (24x7 call incident reporting)
SMS : +60 19 2813801 (24x7 SMS reporting)
Business Hours : Mon - Fri 08:30 -17:30 MYT
Web: <https://www.mycert.org.my>
**5.0 References**
- <http://drupal.org/node/507572>
- <http://www.securityfocus.com/bid/35548/>