SA-CONTRIB-2014-065 - Custom Meta - Cross Site Scripting (XSS)

The module allows you to define and manage custom meta tags.

The module does not sufficiently sanitize user input before displaying the attribute and content values for meta tags on the administration page.

This vulnerability is mitigated by the fact that an attacker must have access to an account with the permission “administer custom meta settings”.

CVE identifier(s) issued

• CVE-2014-4506

Versions affected

• Custom Meta 6.x-1.x versions prior to 6.x-1.2.
• Custom Meta 7.x-1.x versions prior to 7.x-1.2.

Drupal core is not affected. If you do not use the contributed Custom Meta module, there is nothing you need to do.

Solution

Install the latest version:

• If you use Custom Meta for Drupal 6.x, upgrade to Custom Meta 6.x-1.2
• If you use Custom Meta for Drupal 7.x, upgrade to Custom Meta 7.x-1.3

Also see the Custom Meta project page.

Reported by

• Ubani Balogun

Fixed by

• Louis Jimenez the module co-maintainer
• Ubani Balogun

Coordinated by

• Rick Manelius of the Drupal Security Team