Display Suite - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-095

Display Suite allows you to take full control over how your content is displayed using a drag and drop interface.

In certain situations, Display Suite does not properly sanitize some of the output, allowing a malicious user to embed scripts within a page, resulting in a Cross-site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker has to be able to configure field display settings, which usually needs a higher level permission such as administer taxonomy.

CVE identifier(s) issued

• CVE-2015-4392

Versions affected

• Display Suite version 7.x-2.7. Versions prior to Display Suite 7.x-2.7 are not vulnerable.

Drupal core is not affected. If you do not use the contributed Display Suite module,
there is nothing you need to do.

Solution

Install the latest version:

• If you use the Display Suite module for Drupal 7.x-2.7, upgrade to Display Suite 7.x-2.8

Also see the Display Suite project page.

Reported by

• Ward Van Hooreweghe
• Bram Goffings

Fixed by

• Bram Goffings the module maintainer

Coordinated by

• Ivo Van Geertruyen of the Drupal Security Team