SA-CONTRIB-2015-040 - Webform prepopulate block - Cross Site Scripting (XSS)

Webform prepopulate block module enables you to set a webform component to display in a separated block.

The module doesn’t sufficiently sanitize user supplied text when displaying the block, thereby exposing a Cross Site Scripting vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit nodes.

CVE identifier(s) issued

• CVE-2015-1621

Versions affected

• Webform prepopulate block 7.x-3.0

Drupal core is not affected. If you do not use the contributed Webform prepopulate block module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Webform prepopulate block module for Drupal 7.x, upgrade to Webform prepopulate block 7.x-3.1

Also see the Webform prepopulate block project page.

Reported by

• Pere Orga of the Drupal Security Team

Fixed by

• Gabor Szanto the module maintainer

Coordinated by

• Pere Orga of the Drupal Security Team