Compass Rose - Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-138

Compass Rose module provides a type of CCK field that allows to represent the most common orientations (North, North-East, East, South-East, South, South-West, West and North-West).

The module was embedding a JavaScript library from an external source that was not reliable, thereby exposing the site to a Cross Site Scripting (XSS) vulnerability.

CVE identifier(s) issued

• CVE-2015-7980

Versions affected

• Compass Rose 6.x-1.x versions prior to 6.x-1.1.

Drupal core is not affected. If you do not use the contributed Compass Rose module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Compass Rose module for Drupal 6.x, upgrade to Compass Rose 6.x-1.1

Also see the Compass Rose project page.

Reported by

• Dean Flory

Fixed by

• Pablo López the module maintainer

Coordinated by

• Pere Orga of the Drupal Security Team