[Security-news] Services single sign-on client - Critical - Cross-site scripting - SA-CONTRIB-2017-087

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2017-087

Project: Services single sign-on client [1]
Version: 7.x-1.x-dev
Date: 2017-November-29
Security risk: *Critical* 16∕25
AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2]
Vulnerability: Cross-site scripting

Description: 
This module allows users of a remote Services-enabled Drupal site to sign on
to a second site with their credentials.

The module does not sanitize information from the request before displaying
it, thereby exposing a cross-site scripting vulnerability.

Solution: 
Install the latest version:

   * If you use the Services Single Sign-on Client module for Drupal 7.x,
     upgrade to Services Single Sign-on Client 7.x-1.6 [3]

Reported By: 
   * Scott Allison [4]

Fixed By: 
   * Scott Allison [5]
   * Brandon Stone [6] the module maintainer

Coordinated By: 
   * David Rothstein [7] of the Drupal Security Team
   * Lee Rowlands [8] of the Drupal Security Team


[1] https://www.drupal.org/project/services_sso_client
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/services_sso_client/releases/7.x-1.6
[4] https://www.drupal.org/u/scottallison
[5] https://www.drupal.org/u/scottallison
[6] https://www.drupal.org/u/branana
[7] https://www.drupal.org/u/david_rothstein
[8] https://www.drupal.org/u/larowlan