SA-CONTRIB-2014-059 - Touch Theme - Cross Site Scripting (XSS)

Touch Theme is a light weight theme with modern look and feel.

The theme does not sufficiently sanitize theme settings input for Twitter and Facebook username.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission “Administer themes”.

CVE identifier(s) issued

• CVE-2014-4303

Versions affected

• Touch 7.x-1.x versions prior to 7.x-1.9.

Drupal core is not affected. If you do not use the contributed Touch module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Touch theme for Drupal 7.x, upgrade to Touch 7.x-1.9

Also see the Touch project page.

Reported by

• Dennis Walgaard

Fixed by

• Tom Kirkpatrick provisional Drupal Security Team member

Coordinated by

• Tom Kirkpatrick provisional Drupal Security Team member