[Security-news] Automated Logout - Moderately critical - Cross Site Scripting - SA-CONTRIB-2017-081

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2017-081

Project: Automated Logout [1]
Version: 7.x-4.x-dev
Date: 2017-November-01
Security risk: *Moderately critical* 14∕25
AC:Basic/A:Admin/CI:Some/II:Some/E:Proof/TD:All [2]
Vulnerability: Cross Site Scripting

Description: 
This module provides a site administrator the ability to log users out after
a specified time of inactivity. It is highly customizable and includes "site
policies" by role to enforce log out.

The module does not sufficiently filter user-supplied text that is stored in
the configuration, resulting in a persistent Cross Site Scripting
vulnerability (XSS).

This vulnerability is mitigated by the fact that an attacker must have a role
with the permission "administer autologout".

Solution: 
Install the latest version:

   * If you use the Automated Logout module for Drupal 7, upgrade to Automated
     Logout 7.x-4.5 [3]

Reported By: 
   * Nancy Wichmann [4]

Fixed By: 
   * Nancy Wichmann [5]
   * Ajit Shinde [6] the module maintainer

Coordinated By: 
   * David Snopek [7] of the Drupal Security Team


[1] https://www.drupal.org/project/autologout
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/autologout/releases/7.x-4.5
[4] https://www.drupal.org/u/nancydru
[5] https://www.drupal.org/u/nancydru
[6] https://www.drupal.org/u/ajits
[7] https://www.drupal.org/user/u/dsnopek