SA-CONTRIB-2013-036 - Zero Point - Cross Site Scripting (XSS)

Zero Point is a theme which includes many options, ideal for a wide range of sites. The theme does not escape user supplied text which creates a reflected Cross site scripting (XSS) vulnerability in URLs. There are no mitigating factors.

CVE identifier(s) issued

• CVE-2013-1905

Versions affected

• zeropoint 7.x-1.x versions prior to 7.x-1.9.

Drupal core is not affected. If you do not use the contributed Zero Point module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Zero Point theme for Drupal 7.x, upgrade to zeropoint 7.x-1.9

Also see the Zero Point project page.

Reported by

• Dennis Walgaard

Fixed by

• Florian Radut the module maintainer
• Dennis Walgaard

Coordinated by

• Greg Knaddison of the Drupal Security Team