- Advisory ID: DRUPAL-SA-CONTRIB-2014-020
- Project: Drupal Commons (third-party distribution)
- Version: 7.x
- Date: 2014-02-12
- Security risk: Moderately critical
- Exploitable from: Remote
- Vulnerability: Cross Site Scripting
Description
Drupal Commons is a ready-to-use solution for building either internal or external communities. It provides a complete social business software solution for organizations. Drupal Commons displays an "activity stream" containing messages about actions users take on the site.
In some cases, messages about content creation are not properly sanitized, leading to cross site scripting in those messages.
The vulnerability is mitigated in that only certain kinds of activity stream messages are affected, and not all arbitrary script can be executed.
CVE identifier(s) issued
- CVE-2014-8747
Versions affected
- Drupal Commons 7.x-3.x versions prior to 7.x-3.9.
Drupal core is not affected. If you do not use the contributed Drupal Commons distribution, there is nothing you need to do.
Solution
Install the latest version:
- If you use the Drupal 7 Commons distribution, upgrade to Commons 7.x-3.9
Also see the Drupal Commons project page.
Reported by
Fixed by
- Jakob Perry the project maintainer
- Ezra Gildesgame
Coordinated by
- Peter Wolanin of the Drupal Security Team
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.
Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.
Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity
