Description:
Nice Dash module provides site administrators the ability to create dashboards with custom widgets.

The module doesn't sufficiently filter user-supplied data in its admin screens leading to a Cross Site Scripting (XSS) vulnerability which could allow a user to change workflows including injecting malicious scripts to exploit the XSS.

This vulnerability is mitigated by the fact that an attacker must have a role with the administer nice dashboard.

Versions Affected:
version affected: <= 6.x-2.x

See attached patch for a fix applied on the 6.x-2.x branch of nice_dash module.

CommentFileSizeAuthor
nice_dash_xss_fix.patch3.62 KBlirantal

Comments

damienmckenna’s picture

damienmckenna
Location TN, USA
commented

This should have been submitted as a security report!

greggles reminded me that only modules with stable releases (which this doesn't have) are covered by the security procedures, all others should be handled via issues in the respective issue queues. I apologize for jumping the gun.