[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Full-disclosure] Drupal Context Module XSS
- To: "Justin C. Klein Keane" <justin@xxxxxxxxxxxx>
- Subject: Re: [Full-disclosure] Drupal Context Module XSS
- From: Andrew Farmer <andfarm@xxxxxxxxx>
- Date: Mon, 10 May 2010 22:33:22 -0700
On 10 May 2010, at 06:08, Justin C. Klein Keane wrote:
> Drupal security responds that they do not coordinate security fixes for
> modules in release candidate designation. Vulnerability was reported to
> the module maintainer via the public issue queue at the direction of
> Drupal security.
Also, isn't it pretty well established by this point that Drupal generally
doesn't consider XSS to be a vulnerability if you need an admin account to
trigger it?
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/