SA-CONTRIB-2015-074 - Site Documentation - Cross Site Scripting (XSS)

Site Documentation module enables you to display detailed configuration information.

The module doesn’t sufficiently sanitize user supplied text in some pages, thereby exposing a Cross Site Scripting vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a user with permission to create/edit taxonomy terms.

CVE identifier(s) issued

• CVE-2015-4370

Versions affected

• Site Documentation 6.x-1.x versions prior to 6.x-1.5.

Drupal core is not affected. If you do not use the contributed Site Documentation module,
there is nothing you need to do.

Solution

Install the latest version:

• If you use the Site Documentation module for Drupal 6.x, upgrade to Site Documentation 6.x-1.5

Also see the Site Documentation project page.

Reported by

• Pere Orga of the Drupal Security Team

Fixed by

• Nancy Wichmann the module maintainer

Coordinated by

• Pere Orga of the Drupal Security Team