SA-CONTRIB-2013-076 - jQuery Countdown - Cross Site Scripting (XSS)

This jQuery Countdown Module enables you to display a countdown block based upon date settings.

The jQuery Countdown Module does not properly sanitize the settings, allowing a malicious user to embed scripts within a page, resulting in a Cross-site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have the “access administration pages” permission.

CVE identifier(s) issued

• CVE-2013-4383

Versions affected

• jquery_countdown 7.x-1.x versions prior to 7.x-1.0.

Drupal core is not affected. If you do not use the contributed jQuery Countdown module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the jQuery Countdown module, upgrade to jQuery Countdown 7.x-1.1

Also see the jQuery Countdown project page.

Reported by

• Joachim Noreiko

Fixed by

• Dennis Brücke the module maintainer

Coordinated by

• Greg Knaddison and Lee Rowlands of the Drupal Security Team