[IT-SecNots] [Security-news] Panopoly Core - Moderately critical - Cross Site Scripting - SA-CONTRIB-2017-093

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2017-093

Project: Panopoly Core [1]
Version: 7.x-1.x-dev
Date: 2017-December-13
Security risk: *Moderately critical* 13∕25
AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2]
Vulnerability: Cross Site Scripting

Description: 
This module provides common functionality used by other modules in the
Panopoly distribution and child distributions, like, Open Atrium.

The module doesn't sufficiently filter node titles used in breadcrumbs when
the "Append Page Title to Site Breadcrumb" setting is enabled.

This vulnerability is mitigated by the fact that an attacker must have a role
with the ability to create content.

Solution: 
Install the latest version:

  * If you use the Panopoly Core module for Drupal 7.x, upgrade to Panopoly
    Core 7.x-1.49 [3]

Reported By: 
  * Brian Osborne [4]

Fixed By: 
  * David Snopek [5] the module maintainer
  * Brian Osborne [6]

Coordinated By: 
  * David Snopek [7] of the Drupal Security Team


[1] https://www.drupal.org/project/panopoly_core
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/panopoly_core/releases/7.x-1.49
[4] https://www.drupal.org/user/788032
[5] https://www.drupal.org/user/266527
[6] https://www.drupal.org/user/788032
[7] https://www.drupal.org/user/266527

_______________________________________________
Security-news mailing list
Security-news AT drupal.org
Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news