Shibboleth authentication - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-129

Shibboleth authentication module allows users to log in and get permissions based on federated (SAML2) authentication.

The module didn’t filter the text that is displayed as a login link.

This vulnerability was mitigated by the fact that an attacker must have a role with the permission Administer blocks.

CVE identifier(s) issued

• CVE-2015-5513

Versions affected

• Shibboleth authentication 6.x-4.x versions prior to 6.x-4.2.
• Shibboleth authentication 7.x-4.x versions prior to 7.x-4.2.

Drupal core is not affected. If you do not use the contributed Shibboleth authentication module, there is nothing you need to do.

Solution

• If you use the Shibboleth authentication module for Drupal 7.x, upgrade to Shibboleth authentication 7.x-4.2
• If you use the Shibboleth authentication module for Drupal 6.x, upgrade to Shibboleth authentication 6.x-4.2

Also see the Shibboleth authentication project page.

Reported by

• Marcello Cerruti

Fixed by

• Kristof Bajnok the module maintainer

Coordinated by

• Michael Hess of the Drupal Security Team