- Advisory ID: DRUPAL-SA-CONTRIB-2014-061
- Project: VideoWhisper Webcam Plugins (third-party module)
- Version: 7.x
- Date: 2014-June-18
- Security risk: Critical
- Exploitable from: Remote
- Vulnerability: Cross Site Scripting
Description
Includes multiple modules for video communications including room listing, pay per view access control.
The module doesn't sufficiently filter user supplied text from the url (reflected cross site scripting). No special permissions are required to exploit this issue.
There are no mitigating factors for this vulnerability.
CVE identifier(s) issued
- CVE-2014-2715
Versions affected
- All versions of VideoWhisper Webcam Plugins.
Drupal core is not affected. If you do not use the contributed module, there is nothing you need to do.
Solution
If you use the VideoWhisper Webcam Plugins module you should uninstall it.
Also see the VideoWhisper Webcam Plugins project page.
Reported by
Some of the vulnerabilities in this advisory were publicly disclosed as CVE-2014-2715 outside of the process to report security issues in Drupal. Issues reported via the Drupal Security Team process normally include the original reporter. Further vulnerabilities were identified by Greg Knaddison while coordinating this issue.
Fixed by
Not applicable.
Coordinated by
- Greg Knaddison of the Drupal Security Team
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact.
Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.
Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity