SA-CONTRIB-2013-071 - Flag - Cross Site Scripting

The Flag module allows creation of customizable flags on entities.

Flag does not properly sanitize the name of a flag on the main flag administration page, allowing a malicious user to embed scripts within a page, resulting in a Cross-site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have the ‘Administer flags’ permission.

CVE identifier(s) issued

• CVE-2013-4336

Versions affected

• Flag 7.x-3.x versions prior to 7.x-3.1.

Drupal core is not affected. If you do not use the contributed Flag module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Flag module for Drupal 7.x, upgrade to Flag 7.x-3.1

Also see the Flag project page.

Reported by

• Justin_KleinKeane

Fixed by

• Justin_KleinKeane
• Joachim Noreiko the module co-maintainer

Coordinated by

• Greg Knaddison of the Drupal Security Team