SA-CONTRIB-2013-028 - Responsive Blog Theme - Cross Site Scripting (XSS)

Responsive Blog Theme is a light weight Drupal 7 theme with a modern look and feel.

The theme doesn’t properly sanitize user-entered content in the social icon leading to a Cross Site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker would have to have the ‘administer themes’ permission.

CVE identifier(s) issued

• CVE-2013-1782

Versions affected

• Responsive Blog Theme 7.x-1.x versions prior to 7.x-1.6.

Drupal core is not affected. If you do not use the contributed Responsive Blog theme, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Responsive Blog Theme for Drupal 7.x, upgrade to Responsive Blog Theme 7.x-1.6

Also see the Responsive Blog project page.

Reported by

• Greg Knaddison of the Drupal Security Team

Fixed by

• saran.quardz the theme maintainer

Coordinated by

• Greg Knaddison of the Drupal Security Team
• Ben Jeavons of the Drupal Security Team