[IT-SecNots] [Security-news] Views - Less critical - Cross site scripting - SA-CONTRIB-2019-036

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2019-036

Project: Views [1]
Version: 7.x-3.x-dev
Date: 2019-March-13
Security risk: *Less critical* 7∕25
AC:Complex/A:None/CI:None/II:None/E:Theoretical/TD:Uncommon [2]
Vulnerability: Cross site scripting

Description: 
This module enables you to create customized lists of data.

The module doesn't sufficiently sanitize certain field types, leading to a
Cross Site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that a view must display a field
with the format "Full data (serialized)" and an attacker must have the
ability to store malicious markup in that field.

Solution: 
Install the latest version:

  * If you use the Views module for Drupal 7.x, upgrade to Views 7.x-3.21 [3]

Also see the Views [4] project page.

Reported By: 
  * Ralf Stamm  [5]

Fixed By: 
  * Ralf Stamm  [6]
  * Damian Lee  [7]
  * Daniel Wehner  [8]
  * David Snopek  [9] of the Drupal Security Team
  * Nate Lampton  [10]

Coordinated By: 
  * Michael Hess [11] of the Drupal Security Team.

-------- ADDITIONAL INFORMATION
----------------------------------------------

Note: Drupal issues individual security advisories for separate
vulnerabilities included in a release, rather than lumping "multiple
vulnerabilities" into a single advisory. All advisories released today for
Views:

  * SA-CONTRIB-2019-034 [12]
  * SA-CONTRIB-2019-035 [13]
  * SA-CONTRIB-2019-036 [14]


[1] https://www.drupal.org/project/views
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/views/releases/7.x-3.21
[4] https://www.drupal.org/project/views
[5] https://www.drupal.org/user/43568
[6] https://www.drupal.org/user/43568
[7] https://www.drupal.org/user/1037976
[8] https://www.drupal.org/user/99340
[9] https://www.drupal.org/user/266527
[10] https://www.drupal.org/user/35821
[11] https://www.drupal.org/u/mlhess
[12] https://www.drupal.org/sa-contrib-2019-034
[13] https://www.drupal.org/sa-contrib-2019-035
[14] https://www.drupal.org/sa-contrib-2019-036

_______________________________________________
Security-news mailing list
Security-news AT drupal.org
Unsubscribe at https://lists.drupal.org/mailman/listinfo/security-news