When using re-colorable themes, color inputs are not sanitized. Malicious color values can be used to insert arbitrary CSS and script code. Successful exploitation requires the “Administer themes” permission.
https://drupal.org/node/1168756
This vulnerability affects the following application versions:
- Drupal 5.0
- Drupal 5.1
- Drupal 5.2
- Drupal 5.3
- Drupal 5.4
- Drupal 5.5
- Drupal 5.6
- Drupal 5.7
- Drupal 5.8
- Drupal 5.9
- Drupal 5.10
- Drupal 5.11
- Drupal 5.12
- Drupal 5.13
- Drupal 5.14
- Drupal 5.15
- Drupal 5.16
- Drupal 5.17
- Drupal 5.18
- Drupal 5.19
- Drupal 5.20
- Drupal 5.21
- Drupal 5.22
- Drupal 5.23
- Drupal 6.0
- Drupal 6.1
- Drupal 6.2
- Drupal 6.3
- Drupal 6.4
- Drupal 6.5
- Drupal 6.6
- Drupal 6.7
- Drupal 6.8
- Drupal 6.9
- Drupal 6.10
- Drupal 6.11
- Drupal 6.12
- Drupal 6.13
- Drupal 6.14
- Drupal 6.15
- Drupal 6.16
- Drupal 6.17
- Drupal 6.18
- Drupal 6.19
- Drupal 6.20