Quick Edit - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-137

This module enables you to in-place edit entities’ fields.

The module doesn’t sufficiently filter entity titles under the scenario where the user starts in-place editing an entity. The module also doesn’t sufficiently filter node titles under the scenario where a node is displayed (albeit only on pages that are not the node page, so e.g. Views listings).

This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create or edit node entities (e.g. page, article …).

CVE identifier(s) issued

• CVE-2015-6753

Versions affected

• Quick Edit 7.x-1.x versions prior to 7.x-1.2.

Drupal core is not affected. If you do not use the contributed Quick Edit module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Quick Edit module for Drupal 7.x, upgrade to Quick Edit 7.x-1.2

Also see the Quick Edit project page.

Reported by

• Joris van Eijden

Fixed by

• Wim Leers the module maintainer
• Théodore Biadala the module maintainer

Coordinated by

• Pere Orga of the Drupal Security Team