SA-CONTRIB-2014-061 - VideoWhisper Webcam Plugins - Cross Site Scripting (XSS) - Unsupported

Includes multiple modules for video communications including room listing, pay per view access control.

The module doesn’t sufficiently filter user supplied text from the url (reflected cross site scripting). No special permissions are required to exploit this issue.

There are no mitigating factors for this vulnerability.

CVE identifier(s) issued

• CVE-2014-2715

Versions affected

• All versions of VideoWhisper Webcam Plugins.

Drupal core is not affected. If you do not use the contributed module, there is nothing you need to do.

Solution

If you use the VideoWhisper Webcam Plugins module you should uninstall it.

Also see the VideoWhisper Webcam Plugins project page.

Reported by

Some of the vulnerabilities in this advisory were publicly disclosed as CVE-2014-2715 outside of the process to report security issues in Drupal. Issues reported via the Drupal Security Team process normally include the original reporter. Further vulnerabilities were identified by Greg Knaddison while coordinating this issue.

Fixed by

Not applicable.

Coordinated by

• Greg Knaddison of the Drupal Security Team