[Security-news] SA-CONTRIB-2014-096 - OAuth2 Client - Cross Site Scripting (XSS)

[security-news at drupal.org]

View online: https://www.drupal.org/node/2352747

   * Advisory ID: DRUPAL-SA-CONTRIB-2014-096
   * Project: OAuth2 Client [1]     (third-party module)
   * Version: 7.x
   * Date: 2014-October-08
   * Security risk: 10/25 ( Moderately Critical)
     AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:All [2]
   * Vulnerability: Cross Site Scripting

-------- DESCRIPTION
---------------------------------------------------------

OAuth2 Client is an API support module, enabling other modules to connect to
services using OAuth2 authentication.

Within its API code the Client class exposes variables in an error message,
which originate from a third party source without proper sanitisation thus
leading to a Cross Site Scripting vulnerability.


-------- CVE IDENTIFIER(S) ISSUED
--------------------------------------------

   * /A CVE identifier [3] will be requested, and added upon issuance, in
     accordance
            with Drupal Security Team processes./

-------- VERSIONS AFFECTED
---------------------------------------------------

   * OAuth2 Client 7.x-2.x versions prior to 7.x-1.2.

Drupal core is not affected. If you do not use the contributed OAuth2 Client
[4] module,
       there is nothing you need to do.

-------- SOLUTION
------------------------------------------------------------

Install the latest version:

   * If you use the OAuth2 Client module for Drupal 7.x, upgrade to OAuth2
     Client 7.x-1.2 [5]

Also see the OAuth2 Client [6] project page.

-------- REPORTED BY
---------------------------------------------------------

   * Balazs Dianiska [7] a provisional member of the Drupal Security Team

-------- FIXED BY
------------------------------------------------------------

   * Dashamir Hoxha [8] the module maintainer
   * Balazs Dianiska [9] a provisional member of the Drupal Security Team

-------- COORDINATED BY
------------------------------------------------------

   * David Stoline [10], member of the Drupal Security Team

-------- CONTACT AND MORE INFORMATION
----------------------------------------

The Drupal security team can be reached at security at drupal.org or via the
contact form at
https://www.drupal.org/contact [11].

Learn more about the Drupal Security team and their policies [12],
       writing secure code for Drupal [13], and
       securing your site [14].


[1] https://www.drupal.org/project/oauth2_client
[2] https://www.drupal.org/security-team/risk-levels
[3] http://cve.mitre.org/
[4] https://www.drupal.org/project/oauth2_client
[5] https://www.drupal.org/node/2335935
[6] https://www.drupal.org/project/oauth2_client
[7] https://www.drupal.org/user/58645
[8] https://www.drupal.org/user/993752
[9] https://www.drupal.org/user/58645
[10] https://www.drupal.org/u/dstol
[11] https://www.drupal.org/contact
[12] https://www.drupal.org/security-team
[13] https://www.drupal.org/writing-secure-code
[14] https://www.drupal.org/security/secure-configuration