drupaleros.com.ar

------------MULTIPLE VULNERABILITIES IN DATABASE ADMINISTRATION (DBA) MODULE------------

* Advisory ID: DRUPAL-SA-2007-013.

* Project: Database Administration (third-party module).

* Version: 4.6.x-1.*, 4.7.x-1.*.

* Date: 2007-April-11.

* Security risk: Critical.

* Exploitable from: Remote.

* Vulnerability: Cross site scripting and cross site request forgery.

Someone under the pseudonym "Liz0ziM" sent a false security alarm to BugTraq
without first contacting the security team:

http://www.securityfocus.com/archive/1/420671/30/0/threaded

This vulnerability is fixed in Drupal 4.5.6, 4.6.4 and onwards. Drupal's new
XSS filter mechanism takes care of all vulnerabilities listed on
http://ha.ckers.org/xss.html (and even more).

If you have already updated to at least 4.5.6 / 4.6.4 then you are safe and you