SA-CONTRIB-2015-080 - Profile2 Privacy - Cross Site Scripting (XSS)

Profile2 Privacy module enables you to show or hide parts of a profile2 entity based on pre-configured field sets with a title and description.

The module doesn’t sufficiently sanitize user supplied text in some pages, thereby exposing a Cross Site Scripting vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission “Administer Profile2 Privacy Levels”.

CVE identifier(s) issued

• CVE-2015-4376

Versions affected

• Profile2 Privacy 7.x-1.x versions prior to 7.x-1.5.

Drupal core is not affected. If you do not use the contributed Profile2 Privacy module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Profile2 Privacy module for Drupal 7.x, upgrade to Profile2 Privacy 7.x-1.5

Also see the Profile2 Privacy project page.

Reported by

• Matt Vance provisional member of the Drupal Security Team

Fixed by

• Matt Vance provisional member of the Drupal Security Team
• Jason Yee, module maintainer
• Maria Fisher, module maintainer
• Greg Knaddison of the Drupal Security Team

Coordinated by

• Matt Vance provisional member of the Drupal Security Team