[Security-news] Search Autocomplete - Moderately critical - Cross Site Scripting - SA-CONTRIB-2018-070

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2018-070

Project: Search Autocomplete [1]
Date: 2018-October-17
Security risk: *Moderately critical* 13∕25
AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2]
Vulnerability: Cross Site Scripting

CVE IDs: CVE-2018-7603
Description: 
This Search Autocomplete module enables you to autocomplete textfield using
data from your website (nodes, comments, etc..).

The module doesn't sufficiently filter user-entered text among the
autocompletion items leading to a Cross Site Scripting (XSS) vulnerability.

This vulnerability can be exploited by any user allowed to create one of the
autocompletion item, for instance, nodes, users, comments.

Solution: 
Install the latest version:

   * If you use the Search Autocomplete module for Drupal 7.x, upgrade to
     Search Autocomplete 7.x-4.8 [3]

Also see the Search Autocomplete [4] project page.

Reported By: 
   * Simon Kapadia  [5]

Fixed By: 
   * Dominique CLAUSE  [6]

Coordinated By: 
   * Greg Knaddison [7] of the Drupal Security Team


[1] https://www.drupal.org/project/search_autocomplete
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/search_autocomplete/releases/7.x-4.8
[4] https://www.drupal.org/project/search_autocomplete
[5] https://www.drupal.org/user/3524044
[6] https://www.drupal.org/user/801982
[7] https://www.drupal.org/u/greggles