The References module for Drupal 7 was recently unsupported:

https://www.drupal.org/node/2869138

It includes a D7 port of the 'nodereference' module, which has a similar vulnerability.

CommentFileSizeAuthor
#2 SA-CONTRIB-2017-038.patch559 bytesdsnopek

Comments

dsnopek created an issue. See original summary.

dsnopek’s picture

dsnopek
he/him
Primary language English
Location USA
commented
Status: Active » Needs review
StatusFileSize
new SA-CONTRIB-2017-038.patch559 bytes

Patch is attached!

dsnopek’s picture

dsnopek
he/him
Primary language English
Location USA
commented
Status: Needs review » Fixed

Commited to repo

Status: Fixed » Closed (fixed)

Automatically closed - issue fixed for 2 weeks with no activity.