SA-CONTRIB-2013-020 - Ubercart - Cross site scripting (XSS)

The Ubercart module for Drupal provides a shopping cart and e-commerce features for Drupal.

The “full name” field in Views did not properly sanitize output.

The vulnerability is mitigated by the fact that an attacker must get far enough in the checkout process to store their name with an order.

CVE identifier(s) issued

• CVE-2013-0322

Versions affected

• Ubercart 7.x-3.x versions prior to 7.x-3.4.

Drupal core is not affected. If you do not use the contributed Ubercart module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Ubercart module for Drupal 7.x, upgrade to Ubercart 7.x-3.4

Also see the Ubercart project page.

Reported by

• 20th

Fixed by

• 20th
• Dave Long the module maintainer

Coordinated by

• Greg Knaddison of the Drupal Security Team