SA-CONTRIB-2012-044 - Contact Forms - Cross Site Scripting

CVE: CVE-2012-2071

This module expands the features of the site wide contact form. It eliminates the drop down category menu by generating a clean looking contact form with a unique path, for each of the contact form categories.

The module doesn’t sufficiently filter user text of the page title and additional information, leading to a cross-site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission “administer site-wide contact form” and the core contact form needs to be enabled.

Versions affected

• Contact forms 6.x-1.x versions prior to 6.x-1.13.

Drupal core is not affected. If you do not use the contributed Contact Forms module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Contact Forms module for Drupal 6.x, upgrade to 6.x-1.13

Also see the Contact Forms project page.

Reported by

• Ivo Van Geertruyen of the Drupal Security Team

Fixed by

• Geoff Davies the module maintainer

Coordinated by

• Greg Knaddison of the Drupal Security Team