SA-CONTRIB-2014-077 - TableField - Cross Site Scripting (XSS)

This module enables you to create a field attached to a entity which stores tabular data. The module doesn’t sufficiently sanitize the field help text when presented to a privileged user.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission “administer content types” or “administer taxonomy”.

CVE identifier(s) issued

• CVE-2014-8378

Versions affected

• TableField 7.x-2.x versions prior to 7.x-2.3.
• TableField versions for Drupal 6 are NOT affected.

Drupal core is not affected. If you do not use the contributed TableField module,
there is nothing you need to do.

Solution

Install the latest version:

• If you use the TableField module for Drupal 7.x, upgrade to TableField 7.x-2.3

Also see the TableField project page.

Reported by

• Matt V.

Fixed by

• Kevin Hankens the module maintainer
• David Snopek of the Drupal Security Team
• Matt V.

Coordinated by

• David Snopek of the Drupal Security Team