Video Consultation - Moderately Critical - Cross Site Scripting (XSS) - Unsupported - SA-CONTRIB-2015-105

Video Consultation module integrates VideoWhisper Video Consultation software with Drupal.

The module doesn’t sufficiently sanitize user supplied text, thereby exposing a Cross Site Scripting vulnerability.

CVE identifier(s) issued

• CVE-2015-5492

Versions affected

All versions of Video Consultation module.

Drupal core is not affected. If you do not use the contributed Video Consultation module, there is nothing you need to do.

Solution

If you use the Video Consultation module you should uninstall it.

Also see the Video Consultation project page.

Reported by

• Michael Hess of the Drupal Security Team

Fixed by

Not applicable.

Coordinated by

• Pere Orga of the Drupal Security Team