SA-CONTRIB-2014-073- Date - Cross Site Scripting (XSS)

Date module provides flexible date/time field type Date field and a Date API that other modules can use.

The module incorrectly prints date field titles without proper sanitization thereby opening a Cross Site Scripting (XSS) vulnerability.

The vulnerability is mitigated by the fact that an attacker must have a permission to create Date fields, such as “administer taxonomy” to add date fields on taxonomy terms.

CVE identifier(s) issued

• CVE-2014-5169

Versions affected

Drupal core is not affected. If you do not use the contributed Date module,
there is nothing you need to do.

Solution

Install the latest version:

• If you use the date module for Drupal 7.x, upgrade to Date 7.x-2.8

Also see the Date project page.

Reported by

• Lucas D Hedding

Fixed by

• Vijayachandran Mani the module maintainer

Coordinated by

• Klaus Purer of the Drupal Security Team