SA-CONTRIB-2013-025 - Fresh Theme - Cross Site Scripting (XSS)

This third-party contributed theme change Drupal’s interface.

The theme doesn’t properly sanitize user-entered content in the 3 slide gallery on the homepage leading to a Cross Site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker would have to have the ‘administer themes’ permission.

CVE identifier(s) issued

• CVE-2013-1779

Versions affected

• Fresh Theme versions prior to 7.x-1.4

Drupal core is not affected. If you do not use the contributed Fresh Theme, there is nothing you need to do.

Solution

Install the latest version:

• Fresh Theme 7.x-1.4

Also see the Fresh Theme project page.

Reported by

• Greg Knaddison of the Drupal Security Team

Fixed by

• saran.quardz the theme maintainer

Coordinated by

• Greg Knaddison of the Drupal Security Team
• Ben Jeavons of the Drupal Security Team