SA-CONTRIB-2012-142 - Spambot - Cross Site Scripting (XSS)

The Spambot module enables you to protect new user registrations from spammers using the database at stopforumspam.com.

Spambot doesn’t sufficiently sanitize API responses from stopforumspam.com when they are logged to the watchdog, allowing a potential XSS attack.

This vulnerability is mitigated by the fact that only stopforumspam.com (or someone pretending to be stopforumspam.com) can exploit it.

CVE: CVE-2012-6582

Versions affected

• Spambot 6.x-3.x versions prior to 6.x-3.2.
• Spambot 7.x-1.x versions prior to 7.x-1.1.

Drupal core is not affected. If you do not use the contributed Spambot module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Spambot module for Drupal 6.x, upgrade to Spambot 6.x-3.2
• If you use the Spambot module for Drupal 7.x, upgrade to Spambot 7.x-1.1

Also see the Spambot project page.

Reported by

• Jimmy Axenhus

Fixed by

• Beng Tan, the module maintainer
• Jimmy Axenhus

Coordinated by

• Greg Knaddison of the Drupal Security Team
• Ben Jeavons of the Drupal Security Team