SA-CONTRIB-2015-042 - Node basket - Multiple vulnerabilities - Unsupported

Node basket module enables you to pick up nodes in a basket.

The module doesn’t sufficiently sanitize user supplied text in some pages, thereby exposing a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a user with permission to create/edit nodes.

Also, the module has CSRF vulnerabilities. A malicious user can cause another user to add/remove nodes of the basket by getting his browser to make a request to a specially-crafted URL.

Also, the module has an Open Redirect vulnerability.

CVE identifier(s) issued

• Cross Site Scripting: CVE-2015-3381 * Cross Site Request Forgery:CVE-2015-3382 * Open redirect:CVE-2015-3383

Versions affected

• All versions of Node basket module.

Drupal core is not affected. If you do not use the contributed Node basket module, there is nothing you need to do.

Solution

If you use the Node basket module you should uninstall it.

Also see the Node basket project page.

Reported by

• Pere Orga of the Drupal Security Team

Fixed by

Not applicable.

Coordinated by

• Pere Orga of the Drupal Security Team