- Advisory ID: DRUPAL-SA-CONTRIB-2014-096
- Project: OAuth2 Client (third-party module)
- Version: 7.x
- Date: 2014-October-08
- Security risk: 10/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:All
- Vulnerability: Cross Site Scripting
Description
OAuth2 Client is an API support module, enabling other modules to connect to services using OAuth2 authentication.
Within its API code the Client class exposes variables in an error message, which originate from a third party source without proper sanitisation thus leading to a Cross Site Scripting vulnerability.
CVE identifier(s) issued
- A CVE identifier will be requested, and added upon issuance, in accordance
with Drupal Security Team processes.
Versions affected
- OAuth2 Client 7.x-2.x versions prior to 7.x-1.2.
Drupal core is not affected. If you do not use the contributed OAuth2 Client module,
there is nothing you need to do.
Solution
Install the latest version:
- If you use the OAuth2 Client module for Drupal 7.x, upgrade to OAuth2 Client 7.x-1.2
Also see the OAuth2 Client project page.
Reported by
- Balazs Dianiska a provisional member of the Drupal Security Team
Fixed by
- Dashamir Hoxha the module maintainer
- Balazs Dianiska a provisional member of the Drupal Security Team
Coordinated by
- David Stoline, member of the Drupal Security Team
Contact and More Information
The Drupal security team can be reached at security at drupal.org or via the contact form at
https://www.drupal.org/contact.
Learn more about the Drupal Security team and their policies,
writing secure code for Drupal, and
securing your site.
Drupal version: