CVE-2011-0771: Input Validation
The Janrain Engage (formerly RPX) module 6.x-1.3 for Drupal does not validate the file for a profile image, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks and possibly execute arbitrary PHP code by causing a crafted avatar to be downloaded from an external login provider site.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2011-0771?
CVE-2011-0771 has a medium severity rating due to its potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2011-0771?
To fix CVE-2011-0771, update the Janrain Engage module to version 6.x-1.4 or later.
Who is affected by CVE-2011-0771?
CVE-2011-0771 affects users of the Janrain Engage module version 6.x-1.3 for Drupal who upload avatar images.
What type of attack does CVE-2011-0771 allow?
CVE-2011-0771 allows attackers to conduct cross-site scripting (XSS) attacks through unvalidated profile image uploads.
What software is related to CVE-2011-0771?
CVE-2011-0771 is related to the Janrain Engage module version 6.x-1.3 running on Drupal.