SA-CONTRIB-2013-026 - Best Responsive Theme - Cross Site Scripting (XSS)

Best Responsive theme is a light weight Drupal 7 theme with a modern look and feel.

The theme doesn’t properly sanitize user-entered content in the social icon leading to a Cross Site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker would have to have the ‘administer themes’ permission.

CVE identifier(s) issued

• CVE-2013-1780

Versions affected

• Best Responsive Theme 7.x-1.x versions prior to 7.x-1.1.

Drupal core is not affected. If you do not use the contributed Best Responsive theme, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Best responsive Theme for Drupal 7.x, upgrade to Best responsive Theme 7.x-1.1

Also see the Best Responsive project page.

Reported by

• Greg Knaddison of the Drupal Security Team

Fixed by

• saran.quardz the theme maintainer

Coordinated by

• Greg Knaddison of the Drupal Security Team
• Ben Jeavons of the Drupal Security Team