[Security-news] SA-CONTRIB-2014-061 - VideoWhisper Webcam Plugins - Cross Site Scripting (XSS) - Unsupported

[security-news at drupal.org]

View online: https://drupal.org/node/2288333

   * Advisory ID: DRUPAL-SA-CONTRIB-2014-061
   * Project: VideoWhisper Webcam Plugins [1] (third-party module)
   * Version: 7.x
   * Date: 2014-June-18
   * Security risk: Critical [2]
   * Exploitable from: Remote
   * Vulnerability: Cross Site Scripting

-------- DESCRIPTION
---------------------------------------------------------

Includes multiple modules for video communications including room listing,
pay per view access control.

The module doesn't sufficiently filter user supplied text from the url
(reflected cross site scripting). No special permissions are required to
exploit this issue.

There are no mitigating factors for this vulnerability.


-------- CVE IDENTIFIER(S) ISSUED
--------------------------------------------

   * /A CVE identifier [3] will be requested, and added upon issuance, in
     accordance with Drupal Security Team processes./

-------- VERSIONS AFFECTED
---------------------------------------------------

   * All versions of VideoWhisper Webcam Plugins.

Drupal core is not affected. If you do not use the contributed
module, there is nothing you need to do.

-------- SOLUTION
------------------------------------------------------------

If you use the VideoWhisper Webcam Plugins module you should uninstall it.

Also see the VideoWhisper Webcam Plugins [4] project page.

-------- REPORTED BY
---------------------------------------------------------

This issue was publicly disclosed as CVE-2014-2715 outside of the process to
report security issues in Drupal. [5] Issues reported via the Drupal Security
Team process normally include the original reporter.

-------- FIXED BY
------------------------------------------------------------

Not applicable.

-------- COORDINATED BY
------------------------------------------------------

   * Greg Knaddison [6] of the Drupal Security Team

-------- CONTACT AND MORE INFORMATION
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
contact form at http://drupal.org/contact [7].

Learn more about the Drupal Security team and their policies [8], writing
secure code for Drupal [9], and securing your site [10].

Follow the Drupal Security Team on Twitter at
https://twitter.com/drupalsecurity [11]


[1] https://drupal.org/project/videowhisper
[2] http://drupal.org/security-team/risk-levels
[3] http://cve.mitre.org/
[4] https://drupal.org/project/videowhisper
[5] https://drupal.org/security-team/report-issue
[6] https://drupal.org/u/greggles
[7] http://drupal.org/contact
[8] http://drupal.org/security-team
[9] http://drupal.org/writing-secure-code
[10] http://drupal.org/security/secure-configuration
[11] https://twitter.com/drupalsecurity