SA-CONTRIB-2015-064 - Ubercart Discount Coupons - Cross Site Scripting (XSS)

Ubercart Discount Coupons module provides discount coupons for Ubercart stores.

The module doesn’t sufficiently sanitize user supplied text in some administration pages, thereby exposing a Cross Site Scripting vulnerability.

The vulnerability is mitigated by the fact that an attacker must have a user with permission to create/edit taxonomy terms. Note that for vocabularies with free tagging enabled, this includes any user with permission to add/edit content of a type to which the vocabulary applies.

CVE identifier(s) issued

• CVE-2015-4358

Versions affected

• Ubercart Discount Coupons 6.x-1.x versions prior to 6.x-1.8

Drupal core is not affected. If you do not use the contributed Ubercart Discount Coupons module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Ubercart Discount Coupons module for Drupal 6.x, upgrade to Ubercart Discount Coupons 6.x-1.8

Also see the Ubercart Discount Coupons project page.

Reported by

• Pere Orga of the Drupal Security Team

Fixed by

• wodenx the module maintainer

Coordinated by

• Pere Orga of the Drupal Security Team