SA-CONTRIB-2014-037 - BlueMasters - Cross Site Scripting

Bluemasters is a responsive layout theme for Drupal 7.

The Bluemasters theme does not properly sanitize theme settings before they are used in the output of a page.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission “administer themes”.

CVE identifier(s) issued

• CVE-2014-7978

Versions affected

• Bluemasters 7.x-2.x versions prior to 7.x-2.1.

Drupal core is not affected. If you do not use the contributed BlueMasters theme, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Bluemasters theme 7.x-2.0 for Drupal 7.x, upgrade to Bluemasters 7.x-2.1.

Also see the BlueMasters project page.

Reported by

• Dennis Walgaard

Fixed by

• George Tsopouridis the theme maintainer

Coordinated by

• Klaus Purer of the Drupal Security Team