Inline Entity Form - Less critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-120

The Inline Entity Form module provides a field widget for inline management (creation, modification, removal) of referenced entities.

The module doesn’t sufficiently sanitize user supplied text, thereby exposing a Cross Site Scripting vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to create/edit fields.

CVE identifier(s) issued

• CVE-2015-5507

Versions affected

• Inline Entity Form 7.x-1.x versions prior to 7.x-1.6.

Drupal core is not affected. If you do not use the contributed Inline Entity Form module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Inline Entity Form module for Drupal 7.x, upgrade to Inline Entity Form 7.x-1.6

Also see the Inline Entity Form project page.

Reported by

• Matt Vance, provisional member of the Drupal Security Team

Fixed by

• Matt Vance, provisional member of the Drupal Security Team