Migrate - Less critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-130

This module enables you to manage migration processes through the administrative UI.

The module doesn’t sufficiently sanitize destination field labels thereby exposing a Cross Site Scripting vulnerability (XSS).

This vulnerability is mitigated by the fact that an attacker must have a role
with permission to create/edit fields (such as “administer taxonomy”), or be able to modify source data being imported by an administrator. Furthermore, the migrate_ui submodule must be enabled.

CVE identifier(s) issued

• CVE-2015-5514

Versions affected

• Migrate 7.x-2.x versions prior to 7.x-2.8.

Drupal core is not affected. If you do not use the contributed Migrate module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the migrate module’s migrate_ui submodule for Drupal 7.x, upgrade to Migrate 7.x-2.8

Also see the Migrate project page.

Reported by

• Benji Fisher

Fixed by

• Benji Fisher
• Mike Ryan, the module maintainer

Coordinated by

• Klaus Purer of the Drupal Security Team