SA-CONTRIB-2013-024 - Creative Theme - Cross Site Scripting (XSS)

Creative Theme is a light weight Drupal 7 theme with a modern look and feel.

The theme doesn’t properly sanitize user-entered content in the social icon leading to a Cross Site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker would have to have the ‘administer themes’ permission.

CVE identifier(s) issued

• CVE-2013-1778

Versions affected

• Creative Theme 7.x-1.x versions prior to 7.x-1.2.

Drupal core is not affected. If you do not use the contributed Creative Theme, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Creative Theme for Drupal 7.x, upgrade to Creative Theme 7.x-1.2

Also see the Creative Theme project page.

Reported by

• Greg Knaddison of the Drupal Security Team

Fixed by

• saran.quardz the theme maintainer

Coordinated by

• Greg Knaddison of the Drupal Security Team
• Ben Jeavons of the Drupal Security Team