Updated: Comment #0

Problem/Motivation

Part of SA-CORE-2013-003
A cross-site scripting vulnerability was found in the Color module. A malicious attacker could trick an authenticated administrative user into visiting a page containing specific JavaScript that could lead to a reflected cross-site scripting attack via JavaScript execution in CSS.

This vulnerability is mitigated by the fact that it can only take place in older browsers, and in a restricted set of modern browsers, namely Opera through user interaction, and Internet Explorer under certain conditions.

Original patch written by David Rothstein.

Proposed resolution

Forward port patch

Remaining tasks

Review

User interface changes

None

API changes

?

None

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

scor’s picture

Issue summary: View changes
scor’s picture

Status: Needs review » Needs work

The last submitted patch, color-xss.1.patch, failed testing.

amateescu’s picture

Status: Needs work » Reviewed & tested by the community
FileSize
2.99 KB
1.23 KB

Cleaned-up the patch a little, this is ready to go.

amateescu’s picture

Priority: Normal » Critical

SA followups are critical, marking as such.

webchick’s picture

Status: Reviewed & tested by the community » Fixed

Committed and pushed to 8.x. Thanks!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.