SA-CONTRIB-2014-016 - Mayo Theme - XSS Vulnerability

The theme settings allow you to link to a header background file.
A URL could be entered that was not properly sanitized leading to XSS vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission “administer themes”.

CVE identifier(s) issued

• CVE-2014-8079

Versions affected

• MAYO Theme 7.x-1.x versions prior to 7.x-1.3.

Drupal core is not affected. If you do not use the contributed MAYO theme, there is nothing you need to do.

Solution

Install the latest version:

• If you use the theme MAYO for Drupal 7.x, upgrade to MAYO 7.x-1.3

Also see the MAYO project page.

Reported by

• Dennis Walgaard

Fixed by

• Dennis Walgaard
• John Powell the theme maintainer

Coordinated by

• Rick Manelius provisional member of the Drupal Security Team