Webform Matrix Component - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-107

The Webform Matrix Component module is an extension of the Webform module that adds Matrix and Table components.

The module doesn’t sufficiently sanitize user supplied text, thereby exposing a Cross Site Scripting vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to create/edit webform nodes.

CVE identifier(s) issued

• CVE-2015-5494

Versions affected

• Webform Matrix Component 7.x-4.x versions prior to 7.x-4.13.

Drupal core is not affected. If you do not use the contributed Webform Matrix Component module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Webform Matrix Component module for Drupal 7.x, upgrade to Webform Matrix Component 7.x-4.13

Also see the Webform Matrix Component project page.

Reported by

• Matt Vance provisional member of the Drupal Security Team

Fixed by

• drupal_rocker the module maintainer

Coordinated by

• Rick Manelius of the Drupal Security Team
• Pere Orga of the Drupal Security Team