SA-CONTRIB-2012-024 - MediaFront - Cross Site Scripting

CVE: CVE-2012-1647

Within the MediaFront module, there is a PHP library for handling the stand alone application of the Open Standard Media player. Within this library, both the $_SESSION and $_SERVER variables are handled without proper checks to make sure that no malicious code is injected within these variables.

Versions affected

• MediaFront 6.x-1.x versions prior to 6.x-1.5.
• MediaFront 7.x-1.x versions prior to 7.x-1.5.

Drupal core is not affected. If you do not use the contributed MediaFront module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Mediafront module for Drupal 6.x, upgrade to Mediafront 6.x-1.5
• If you use the Mediafront module for Drupal 7.x, upgrade to Mediafront 7.x-1.5

See also the MediaFront project page.

Reported by

• Óscar Estepa

Fixed by

• Travis Tidwell the module maintainer

Coordinated by

• Michael Hess of the Drupal Security Team