Shipwire - Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-111

The Shipwire API module handles communication with the Shipwire shipping service.

The Shipwire module doesn’t check view permission for the shipments overview page when installed (admin/shipwire/shipments). Limited non-public information is displayed on the page.

CVE identifier(s) issued

• CVE-2015-5498

Versions affected

• Shipwire 7.x-1.x versions prior to 7.x-1.03.

Drupal core is not affected. If you do not use the contributed Shipwire module,
there is nothing you need to do.

Solution

Install the latest version:

• If you use the Shipwire module for Drupal 7.x, please upgrade to Shipwire 7.x-1.03 or greater.
• Check the settings have been updated by navigating to Structure -> Views -> Shipwire shipment. Under ‘Page settings’ make sure that ‘Access’ is set to ‘Permission’ -> ‘View all Shipwire Shipments’.

Also see the Shipwire project page.

Reported by

• Tinker

Fixed by

• Tinker

Coordinated by

• Matt Vance of the Drupal Security Team