SA-CONTRIB-2012-088 - Mobile Tools - Cross Site Scripting (XSS)

Mobile Tools provides Drupal developers with some tools to assist in making a site mobile.
The module contains several persistent cross site scripting (XSS) vulnerabilities due to the fact that it fails to sanitize user supplied values before display.

CVE: CVE-2012-2717

Versions affected

• Mobile Tools 6.x-2.x versions prior to 6.x-2.3

Drupal core is not affected. If you do not use the contributed Mobile Tools module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Mobile Tools module for Drupal 6.x, upgrade to Mobile Tools 6.x-2.3

Also see the Mobile Tools project page.

Reported by

• Justin Klein Keane

Fixed by

• Mathew Winstone (minorOffense) the module maintainer

Coordinated by

• Michael Hess of the Drupal Security Team
• Greg Knaddison of the Drupal Security Team