SA-CONTRIB-2013-043 - MP3 Player - Cross Site Scripting (XSS)

This module enables you to easily enable a Flash MP3 Player on a CCK FileField.
The module doesn’t sufficiently filter user-supplied text from mp3 filenames.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create a node with an mp3 filefield with the MP3 player set as the display widget.

CVE identifier(s) issued

• CVE-2013-1971

Versions affected

• All MP3 Player versions.

Drupal core is not affected. If you do not use the contributed MP3 Player module, there is nothing you need to do.

Solution

Disable the module:

• If you use the MP3 Player module for Drupal 6.x you should disable the module.

Also see the MP3 Player project page.

Reported by

• Kyle Small

Fixed by

Not applicable.

Coordinated by

• Greg Knaddison of the Drupal Security Team