SA-CONTRIB-2013-070 - Zen - Cross Site Scripting

The Zen theme is a very popular base/starter theme.

Zen doesn’t sufficiently escape the breadcrumb separator field, allowing a possible XSS exploit.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission “administer themes”.

CVE identifier(s) issued

• CVE-2013-4275

Versions affected

• Zen 7.x-3.x versions prior to 7.x-3.2.
• Zen 7.x-5.x versions prior to 7.x-5.4.

Drupal core is not affected. If you do not use the contributed Zen module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Zen theme for Drupal 7.x, upgrade to Zen 7.x-3.2 or Zen 7.x-5.4.

Also see the Zen project page.

Reported by

• Daniel Nitsche

Fixed by

• John Albin Wilkins, the theme maintainer

Coordinated by

• Greg Knaddison of the Drupal Security Team
• Klaus Purer of the Drupal Security Team