View online: https://www.drupal.org/sa-contrib-2017-087
Project: Services single sign-on client [1] Version: 7.x-1.x-dev Date: 2017-November-29 Security risk: *Critical* 16∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site scripting
Description: This module allows users of a remote Services-enabled Drupal site to sign on to a second site with their credentials.
The module does not sanitize information from the request before displaying it, thereby exposing a cross-site scripting vulnerability.
Solution: Install the latest version:
* If you use the Services Single Sign-on Client module for Drupal 7.x, upgrade to Services Single Sign-on Client 7.x-1.6 [3]
Reported By: * Scott Allison [4]
Fixed By: * Scott Allison [5] * Brandon Stone [6] the module maintainer
Coordinated By: * David Rothstein [7] of the Drupal Security Team * Lee Rowlands [8] of the Drupal Security Team
[1] https://www.drupal.org/project/services_sso_client [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/services_sso_client/releases/7.x-1.6 [4] https://www.drupal.org/u/scottallison [5] https://www.drupal.org/u/scottallison [6] https://www.drupal.org/u/branana [7] https://www.drupal.org/u/david_rothstein [8] https://www.drupal.org/u/larowlan