[Security-news] Responsive Menus - Moderately critical - Cross site scripting - SA-CONTRIB-2018-079

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2018-079

Project: Responsive Menus [1]
Version: 7.x-1.x-dev
Date: 2018-December-05
Security risk: *Moderately critical* 13∕25
AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2]
Vulnerability: Cross site scripting

Description: 
This module enables you to collapse your sites main menu on mobile, and show
a menu toggle button.

The module doesn't sufficiently sanitize configuration settings provided by
users which leads to a Cross Site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role
with the permission "administer responsive menus".

Solution: 
Install the latest version:

   * If you use the responsive_menus module for Drupal 7.x, upgrade to
     responsive_menus 7.x-1.7 [3]

Reported By: 
   * Ayesh Karunaratne  [4]

Fixed By: 
   * Joshua Walker  [5]

Coordinated By: 
   * Michael Hess [6] of the Drupal Security Team
   * David Snopek [7] of the Drupal Security Team


[1] https://www.drupal.org/project/responsive_menus
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/responsive_menus/releases/7.x-1.7
[4] https://www.drupal.org/user/796148
[5] https://www.drupal.org/user/433663
[6] https://www.drupal.org/u/mlhess
[7] https://www.drupal.org/u/dsnopek