View online: https://www.drupal.org/sa-contrib-2017-087 Project: Services single sign-on client [1] Version: 7.x-1.x-dev Date: 2017-November-29 Security risk: *Critical* 16∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site scripting Description:  This module allows users of a remote Services-enabled Drupal site to sign on to a second site with their credentials. The module does not sanitize information from the request before displaying it, thereby exposing a cross-site scripting vulnerability. Solution:  Install the latest version: * If you use the Services Single Sign-on Client module for Drupal 7.x, upgrade to Services Single Sign-on Client 7.x-1.6 [3] Reported By:  * Scott Allison [4] Fixed By:  * Scott Allison [5] * Brandon Stone [6] the module maintainer Coordinated By:  * David Rothstein [7] of the Drupal Security Team * Lee Rowlands [8] of the Drupal Security Team [1] https://www.drupal.org/project/services_sso_client [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/services_sso_client/releases/7.x-1.6 [4] https://www.drupal.org/u/scottallison [5] https://www.drupal.org/u/scottallison [6] https://www.drupal.org/u/branana [7] https://www.drupal.org/u/david_rothstein [8] https://www.drupal.org/u/larowlan