SA-CONTRIB-2012-048 - Contact Save - Cross Site Scripting

CVE: CVE-2012-2075

This module stores in the database all messages submitted through the core contact forms, and provides a way to respond to these messages through the website.

The module doesn’t sufficiently filter user supplied text, leading to a cross-site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with either the “access site-wide contact form”.

Versions affected

• Contact Save 6.x-1.x versions prior to 6.x-1.5.

Drupal core is not affected. If you do not use the contributed Contact Save module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Contact Save module for Drupal 6.x, upgrade to Contact Save 6.x-1.5.

Also see the Contact Save project page.

Reported by

• Stella Power of the Drupal Security Team

Fixed by

• Joel Stein the module maintainer