SA-CONTRIB-2011-058 - Support Timer - Cross Site Scripting (XSS)

The Support Timer module adds a javascript-based timer to the Support Ticketing System for tracking how long users are working on support tickets, as well as administrative reports.

The module does not properly sanitize user-supplied content, resulting in multiple Cross-Site Scripting (XSS) vulnerabilities.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission “track time spent”.

CVE identifier(s) issued

• CVE-2011-5188

Versions affected

• Support Timer 6.x-1.x versions prior to 6.x-1.4.

Drupal core is not affected. If you do not use the contributed Support Timer module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Support Timer module for Drupal 6.x, upgrade to Support Timer 6.x-1.4

See also the Support Timer project page.

Reported by

• Brandon Bergren

Fixed by

• Brandon Bergren the module maintainer

Coordinated by

• Greg Knaddison of the Drupal Security Team