SA-CONTRIB-2015-017 - Room Reservations - Cross Site Scripting (XSS)

Room Reservations module enables you to manage a room reservation system.

The module doesn’t sufficiently sanitize the node title of “Room Reservations Category” nodes and the body of “Room Reservations Room” nodes, thereby leading to a Cross Site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a user with the permission “Administer the room reservations system”.

CVE identifier(s) issued

• CVE-2015-3359

Versions affected

• Room Reservations 7.x-1.x versions prior to 7.x-1.1.

Drupal core is not affected. If you do not use the contributed Room Reservations module,
there is nothing you need to do.

Solution

Install the latest version:

• If you use the Room Reservations module for Drupal 7.x, upgrade to Room Reservations 7.x-1.1

Also see the Room Reservations project page.

Reported by

• Pere Orga provisional member of the Drupal Security Team

Fixed by

• Peter Lindstrom the module maintainer

Coordinated by

• Pere Orga provisional member of the Drupal Security Team