Marked as normal since this is a security update marked "Less Critical" and colorbox isn't enabled by default.

The module allows unprivileged users to add unexpected content to a Colorbox, including content from external sites. This allows an unprivileged user to deface a site.

This vulnerability is mitigated by the fact that an attacker must have permission to post comments with a text format that allows links.

Though also see #2426715: Remove Colorbox from build.

Comments

rootwork created an issue. See original summary.

lsolesen’s picture

lsolesen commented

We should probably remove this, when it is not enabled by default #2426715: Remove Colorbox from build. @mglaman What is your take on this?

mglaman’s picture

mglaman
Primary language English
Location WI, USA
commented

If we have modules with dependencies.. then let's update it. For now. I'm nervous about just removing modules that people might have enabled.

rolfmeijer’s picture

rolfmeijer commented

To be honest, I don’t think a security update from a module should be open for so long, it should not depend on a decision whether this particular module should be removed from the project.

I would really like it if the update was included in the next release of Commerce Kickstart.

mglaman’s picture

mglaman
Primary language English
Location WI, USA
commented
Status: Active » Needs review

PR: https://github.com/commerceguys/commerce_kickstart/pull/207

Going into next release.

rolfmeijer’s picture

rolfmeijer commented

Wow, thank you! What a quick action. I will try to test it as soon as possible.

  • mglaman authored f4c5fb4 on 7.x-2.x 
    Issue #2708845: Update colorbox (#207)
mglaman’s picture

mglaman
Primary language English
Location WI, USA
commented
Status: Needs review » Fixed

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.