SA-CONTRIB-2015-047 - Panopoly Magic - Cross Site Scripting (XSS)

This module enables live previews of Panels panes in the modal dialog for adding or editing them.

The module doesn’t sufficiently filter the pane title when re-rendering the live preview.

This vulnerability is mitigated by the fact that an attacker must have permission to add or edit Panels panes.

CVE identifier(s) issued

• CVE-2015-2086

Versions affected

• Panopoly Magic 7.x-1.x versions prior to 7.x-1.17.

Drupal core is not affected. If you do not use the contributed Panopoly Magic module,
there is nothing you need to do.

Solution

Install the latest version:

• If you use the Panopoly Magic module for Drupal 7.x, upgrade to Panopoly Magic 7.x-1.17

Also see the Panopoly Magic project page.

Reported by

• David Snopek of the Drupal Security Team

Fixed by

• David Snopek of the Drupal Security Team
• Matt Cheney

Coordinated by

• David Snopek of the Drupal Security Team