496289 - Advisory ID: DRUPAL-SA-CONTRIB-2009-0322 WEBFORM

Status: RESOLVED FIXED

(Websites Graveyard :: spreadthunderbird.com, defect)

Description

[Paul Booker]

Hi Gozer,

Would you upgrade our disabled webform module on stage / production so that we can't turn on a module which is a moderately critical security risk. I'll then update our Wiki, thanks.

 * Advisory ID: DRUPAL-SA-CONTRIB-2009-032
 * Project: Webform (third-party module)
 * Versions: 5.x, 6.x
 * Date: 2009-June-03
 * Security risk: Moderately critical
 * Exploitable from: Remote
 * Vulnerability: Cross-site scripting

-------- DESCRIPTION ---------------------------------------------------------

The Webform module provides a node type which is typically used to enable
site visitors to fill in questionnaires, contact or request/registration
forms, surveys, polls, or other forms on a Drupal site. When displaying the
results of Webform submissions, the module does not properly filter user
entered data, leading to a cross-site scripting [1] (XSS) vulnerability on
sites with a specific configuration of input formats that would normally be
safe. Such an attack carried out against a sufficiently privileged user may
lead a malicious user to gain administrator access to the site.
-------- VERSIONS AFFECTED ---------------------------------------------------

 * Versions of Webform for Drupal 5.x prior to 5.x-2.7
 * Versions of Webform for Drupal 6.x prior to 6.x-2.7

Drupal core is not affected. If you do not use the contributed Webform
module, there is nothing you need to do.
-------- SOLUTION ------------------------------------------------------------

Install the latest version:
 * If you use Webform for Drupal 5.x, upgrade to Webform 5.x-2.7 [2].
 * If you use Webform for Drupal 6.x, upgrade to Webform 6.x-2.7 [3].

See also the Webform project page [4].
-------- REPORTED BY ---------------------------------------------------------

David Rothstein [5]
-------- FIXED BY ------------------------------------------------------------

Nathan Haug (quicksketch [6]), and David Rothstein [7] of the Drupal Security
Team [8]

Comment 1

[Paul Booker]

Can we push this through to stage / production, thanks

Comment 2

[Philippe M. Chiasson (:gozer)]

Build, packaged and updated in stage and production.

Please verify and close.

Comment 3

[Paul Booker]

Verified.

Thanks, Paul