Updated: Comment #0

Problem/Motivation

Part of SA-CORE-2013-003
A cross-site scripting vulnerability was found in the Color module. A malicious attacker could trick an authenticated administrative user into visiting a page containing specific JavaScript that could lead to a reflected cross-site scripting attack via JavaScript execution in CSS.

This vulnerability is mitigated by the fact that it can only take place in older browsers, and in a restricted set of modern browsers, namely Opera through user interaction, and Internet Explorer under certain conditions.

Original patch written by David Rothstein.

Proposed resolution

Forward port patch

Remaining tasks

Review

User interface changes

None

API changes

?

None

CommentFileSizeAuthor
#4 interdiff.txt1.23 KBamateescu
#4 2140459-4.patch2.99 KBamateescu
color-xss.1.patch2.95 KBlarowlan

Comments

scor’s picture

scor commented
Issue summary: View changes
scor’s picture

scor commented
Issue tags: +Security Advisory follow-up, +SA-CORE-2013-003

Status: Needs review » Needs work

The last submitted patch, color-xss.1.patch, failed testing.

amateescu’s picture

amateescu commented
Status: Needs work » Reviewed & tested by the community
StatusFileSize
new 2140459-4.patch2.99 KB
new interdiff.txt1.23 KB

Cleaned-up the patch a little, this is ready to go.

amateescu’s picture

amateescu commented
Priority: Normal » Critical

SA followups are critical, marking as such.

webchick’s picture

webchick
she/they
Primary language English
Location Vancouver 🇨🇦
commented
Status: Reviewed & tested by the community » Fixed

Committed and pushed to 8.x. Thanks!

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.