Stored XSS in Drupal Zero Point

Executive Summary

This is a Stored Cross-site Scripting (XSS) vulnerability in the Drupal Zero Point module. It allows attackers to inject malicious scripts into web pages that are then stored and served to other users. The flaw exists due to improper neutralization of user input during web page generation.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to steal user sessions, deface websites, or deliver malware. Users visiting compromised pages may have their data exposed or their browsers compromised. The stored nature means the attack persists until the malicious content is manually removed.

Useful 0 Not Useful 0

Mitigation Strategies

Update Drupal Zero Point to a version outside the affected range (0.0.0-1.30.0, 2.0.0-2.0.1). Remove or disable the module if updates are not possible. Scan for signs of exploitation such as unexpected scripts in web pages.

Useful 0 Not Useful 0