SA-CONTRIB-2013-060 - Scald - Cross Site Scripting (XSS)

This module enables you to handle media assets (atoms) in Drupal with a Views-based library, drag and drop interface and manage content attribution/licensing/distribution.

The module doesn’t sufficiently filter atom properties such as the atom title when outputting atoms, thereby exposing a Cross Site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create atoms and the Scald Flash module or the resource management feature (in the MEE submodule) must be enabled.

CVE identifier(s) issued

• CVE-2013-4174

Versions affected

• Scald 6.x-1.x versions prior to 6.x-1.0-beta3.
• Scald 7.x-1.x versions prior to 7.x-1.1.

Drupal core is not affected. If you do not use the contributed Scald module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Scald module for Drupal 6.x, upgrade to Scald 6.x-1.0-beta3
• If you use the Scald module for Drupal 7.x, upgrade to Scald 7.x-1.1

Also see the Scald project page.

Reported by

• Klaus Purer of the Drupal Security Team

Fixed by

• Franck Deroche the module maintainer
• Hai-Nam Nguyen the module maintainer

Coordinated by

• Klaus Purer of the Drupal Security Team