SA-CONTRIB-2014-116 - Webform Invitation - Cross Site Scripting (XSS)

This module enables you to create custom invitation codes for Webforms.

The module failed to sanitize node titles.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission “Webform: Create new content”, “Webform: Edit own content” and/or “Webform: Edit any content”.

CVE identifier(s) issued

• CVE-2014-9498

Versions affected

• Webform Invitation 7.x-1.x versions prior to 7.x-1.3.
• Webform Invitation 7.x-2.x versions prior to 7.x-2.4.

Drupal core is not affected. If you do not use the contributed Webform Invitation module,
there is nothing you need to do.

Solution

Install the latest version:

• If you use the Webform Invitation module for Drupal 7.x and Webform 7.x-3.x, upgrade to Webform Invitation 7.x-1.3
• If you use the Webform Invitation module for Drupal 7.x and Webform 7.x-4.x, upgrade to Webform Invitation 7.x-2.4

Also see the Webform Invitation project page.

Reported by

• Pere Orga

Fixed by

• Christian Paul Bruhn the module maintainer
• Pere Orga

Coordinated by

• Ben Dougherty provisional member of the Drupal Security Team