View online: https://www.drupal.org/node/2463843 * Advisory ID: DRUPAL-SA-CONTRIB-2015-091 * Project: Current Search Links [1] (third-party module) * Version: 7.x * Date: 2015-April-01 * Security risk: 15/25 ( Critical) AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- Current Search Links module is an extension to the Facet API Current Search Blocks module. Instead of just showing the current search it turns the current search keywords into links that you can drop from the search. The module doesn't sufficiently sanitize the entered search query, thereby exposing a XSS vulnerability. An attacker could exploit this vulnerability by getting the victim to visit a specially-crafted URL. This is mitigated by the fact that only sites with the option "Append the keywords passed by the user to the list" disabled are affected. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Current Search Links 7.x-1.x versions prior to 7.x-1.1. Drupal core is not affected. If you do not use the contributed Current Search Links [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Current Search Links module for Drupal 7.x, upgrade to Current Search Links 7.x-1.1 [5] Also see the Current Search Links [6] project page. -------- REPORTED BY --------------------------------------------------------- * Sogeti security team * Martijn de Wit [7] -------- FIXED BY ------------------------------------------------------------ * Johnny van de Laar [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Pere Orga [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [14] [1] https://www.drupal.org/project/current_search_links [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/current_search_links [5] https://www.drupal.org/node/2463493 [6] https://www.drupal.org/project/current_search_links [7] https://www.drupal.org/user/83953 [8] https://www.drupal.org/user/248932 [9] https://www.drupal.org/user/2301194 [10] https://www.drupal.org/contact [11] https://www.drupal.org/security-team [12] https://www.drupal.org/writing-secure-code [13] https://www.drupal.org/security/secure-configuration [14] https://twitter.com/drupalsecurity