• Advisory ID: DRUPAL-SA-CONTRIB-2014-061
  • Project: VideoWhisper Webcam Plugins (third-party module)
  • Version: 7.x
  • Date: 2014-June-18
  • Security risk: Critical
  • Exploitable from: Remote
  • Vulnerability: Cross Site Scripting

Description

Includes multiple modules for video communications including room listing, pay per view access control.

The module doesn't sufficiently filter user supplied text from the url (reflected cross site scripting). No special permissions are required to exploit this issue.

There are no mitigating factors for this vulnerability.

CVE identifier(s) issued

  • CVE-2014-2715

Versions affected

  • All versions of VideoWhisper Webcam Plugins.

Drupal core is not affected. If you do not use the contributed module, there is nothing you need to do.

Solution

If you use the VideoWhisper Webcam Plugins module you should uninstall it.

Also see the VideoWhisper Webcam Plugins project page.

Reported by

Some of the vulnerabilities in this advisory were publicly disclosed as CVE-2014-2715 outside of the process to report security issues in Drupal. Issues reported via the Drupal Security Team process normally include the original reporter. Further vulnerabilities were identified by Greg Knaddison while coordinating this issue.

Fixed by

Not applicable.

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.


Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity