SA-CONTRIB-2015-018 - Video - Cross Site Scripting (XSS)

This module enables you to upload, convert and playback videos.

The module doesn’t sufficiently sanitize node titles when using the video WYSIWYG plugin, thereby opening a Cross Site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission “create video nodes” and that WYSIWYG video plugin must be enabled.

CVE identifier(s) issued

• CVE-2015-3362

Versions affected

• Video 7.x-2.x versions from 7.x-2.2-beta1 to 7.x-2.10.

Drupal core is not affected. If you do not use the contributed Video module,
there is nothing you need to do.

Solution

Install the latest version:

• If you use the video module for Drupal 7.x-2.x, upgrade to Video 7.x-2.11

Also see the Video project page.

Reported by

• Pere Orga provisional member of the Drupal Security Team

Fixed by

• Heshan Wanigasooriya the module maintainer

Coordinated by

• Pere Orga provisional member of the Drupal Security Team