SA-CONTRIB-2014-044 - Professional Theme - Cross Site Scripting (XSS)

Professional Theme is a modern and professional Drupal theme.

The theme does not sufficiently sanitize theme settings input for custom copyright information

This vulnerability is mitigated by the fact that an attacker must have a role with the permission “Administer themes”.

CVE identifier(s) issued

• CVE-2014-8076

Versions affected

• Professional Theme for 7.x prior to 7.x-2.04

Drupal core is not affected. If you do not use the contributed Professional Theme module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Professional Theme for Drupal 7.x, upgrade to 7.x-2.04

Also see the Professional Theme project page.

Reported by

• Dennis Walgaard

Fixed by

• Matt Heinke the theme maintainer
• Dennis Walgaard

Coordinated by

• Matt Kleve of the Drupal Security Team