http://localhost:8080/trac/ticket/789 <p> View online: <a class="ext-link" href="https://www.drupal.org/node/2340029"><span class="icon">​</span>https://www.drupal.org/node/2340029</a> </p> <ul><li>Advisory ID: DRUPAL-SA-CONTRIB-2014-088 </li><li>Project: Mollom <a class="missing changeset" title="No default repository defined">[1]</a> (third-party module) </li><li>Version: 6.x, 7.x </li><li>Date: 2014-September-17 </li><li>Security risk: 11/25 ( Moderately Critical) </li></ul><p> AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon <a class="missing changeset" title="No default repository defined">[2]</a> </p> <ul><li>Vulnerability: Cross Site Scripting </li></ul><hr /> <hr /> <p> Mollom is an "intelligent" content moderation web service which determines if a post is potentially spam; not only based on the posted content, but also on the past activity and reputation of the poster across multiple sites. </p> <p> Mollom offers a feature to report submitted content as inappropriate which allows end users to indicate that a piece of site content is objectionable or out of place. When reporting content, the content title is not sufficiently sanitized to prevent cross-site scripting (XSS) attacks. </p> <p> This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create content and the content type must be enabled for "Flag as Inappropriate" within the Mollom advanced configuration settings (which is not the default setting). </p> <hr /> <hr /> <ul><li>/A CVE identifier <a class="missing changeset" title="No default repository defined">[3]</a> will be requested, and added upon issuance, in </li></ul><p> accordance with Drupal Security Team processes./ </p> <hr /> <hr /> <ul><li>Mollom 6.x-2.x versions from 6.x-2.7 to 6.x-2.10 </li><li>Mollom 7.x-2.x versions from 7.x-2.9 to 7.x-2.10 </li></ul><p> Drupal core is not affected. If you do not use the contributed Mollom <a class="missing changeset" title="No default repository defined">[4]</a> module, there is nothing you need to do. </p> <hr /> <hr /> <p> Install the latest version: </p> <ul><li>If you use the Mollom module for Drupal 6.x, upgrade to Mollom 6.x-2.11 </li></ul><p> <a class="missing changeset" title="No default repository defined">[5]</a> </p> <ul><li>If you use the Mollom module for Drupal 7.x, upgrade to Mollom 7.x-2.11 </li></ul><p> <a class="missing changeset" title="No default repository defined">[6]</a> </p> <p> Also see the Mollom <a class="missing changeset" title="No default repository defined">[7]</a> project page. </p> <hr /> <hr /> <ul><li>Matt Vance <a class="missing changeset" title="No default repository defined">[8]</a> </li></ul><hr /> <hr /> <ul><li>Lisa Backer <a class="missing changeset" title="No default repository defined">[9]</a> the module maintainer </li><li>Matt Vance <a class="missing changeset" title="No default repository defined">[10]</a> </li></ul><hr /> <hr /> <ul><li>Greg Knaddison <a class="missing changeset" title="No default repository defined">[11]</a> of the Drupal Security Team </li></ul><hr /> <hr /> <p> The Drupal security team can be reached at security at drupal.org or via the contact form at <a class="ext-link" href="https://www.drupal.org/contact"><span class="icon">​</span>https://www.drupal.org/contact</a> <a class="missing changeset" title="No default repository defined">[12]</a>. </p> <p> Learn more about the Drupal Security team and their policies <a class="missing changeset" title="No default repository defined">[13]</a>, writing secure code for Drupal <a class="missing changeset" title="No default repository defined">[14]</a>, and securing your site <a class="missing changeset" title="No default repository defined">[15]</a>. </p> <p> <a class="missing changeset" title="No default repository defined">[1]</a> <a class="ext-link" href="https://www.drupal.org/project/mollom"><span class="icon">​</span>https://www.drupal.org/project/mollom</a> <a class="missing changeset" title="No default repository defined">[2]</a> <a class="ext-link" href="https://www.drupal.org/security-team/risk-levels"><span class="icon">​</span>https://www.drupal.org/security-team/risk-levels</a> <a class="missing changeset" title="No default repository defined">[3]</a> <a class="ext-link" href="http://cve.mitre.org/"><span class="icon">​</span>http://cve.mitre.org/</a> <a class="missing changeset" title="No default repository defined">[4]</a> <a class="ext-link" href="https://www.drupal.org/project/mollom"><span class="icon">​</span>https://www.drupal.org/project/mollom</a> <a class="missing changeset" title="No default repository defined">[5]</a> <a class="ext-link" href="https://www.drupal.org/node/2338787"><span class="icon">​</span>https://www.drupal.org/node/2338787</a> <a class="missing changeset" title="No default repository defined">[6]</a> <a class="ext-link" href="https://www.drupal.org/node/2338789"><span class="icon">​</span>https://www.drupal.org/node/2338789</a> <a class="missing changeset" title="No default repository defined">[7]</a> <a class="ext-link" href="https://www.drupal.org/project/mollom"><span class="icon">​</span>https://www.drupal.org/project/mollom</a> <a class="missing changeset" title="No default repository defined">[8]</a> <a class="ext-link" href="https://www.drupal.org/user/88338"><span class="icon">​</span>https://www.drupal.org/user/88338</a> <a class="missing changeset" title="No default repository defined">[9]</a> <a class="ext-link" href="https://www.drupal.org/user/1951462"><span class="icon">​</span>https://www.drupal.org/user/1951462</a> <a class="missing changeset" title="No default repository defined">[10]</a> <a class="ext-link" href="https://www.drupal.org/user/88338"><span class="icon">​</span>https://www.drupal.org/user/88338</a> <a class="missing changeset" title="No default repository defined">[11]</a> <a class="ext-link" href="https://www.drupal.org/user/36762"><span class="icon">​</span>https://www.drupal.org/user/36762</a> <a class="missing changeset" title="No default repository defined">[12]</a> <a class="ext-link" href="https://www.drupal.org/contact"><span class="icon">​</span>https://www.drupal.org/contact</a> <a class="missing changeset" title="No default repository defined">[13]</a> <a class="ext-link" href="https://www.drupal.org/security-team"><span class="icon">​</span>https://www.drupal.org/security-team</a> <a class="missing changeset" title="No default repository defined">[14]</a> <a class="ext-link" href="https://www.drupal.org/writing-secure-code"><span class="icon">​</span>https://www.drupal.org/writing-secure-code</a> <a class="missing changeset" title="No default repository defined">[15]</a> <a class="ext-link" href="https://www.drupal.org/security/secure-configuration"><span class="icon">​</span>https://www.drupal.org/security/secure-configuration</a> </p> en-us /trac/chrome/site/TransitionNetwork-Logo-Web-Small.jpg http://localhost:8080/trac/ticket/789 Trac 0.12.5 paul Mon, 22 Sep 2014 13:12:09 GMT http://localhost:8080/trac/ticket/789#comment:1 http://localhost:8080/trac/ticket/789#comment:1 <ul> <li><strong>hours</strong> changed from <em>0.0</em> to <em>0.125</em> </li> <li><strong>totalhours</strong> changed from <em>0.0</em> to <em>0.125</em> </li> </ul> <p> Updating now .. </p> Ticket paul Mon, 22 Sep 2014 13:25:41 GMT http://localhost:8080/trac/ticket/789#comment:2 http://localhost:8080/trac/ticket/789#comment:2 <ul> <li><strong>hours</strong> changed from <em>0.0</em> to <em>0.25</em> </li> <li><strong>totalhours</strong> changed from <em>0.125</em> to <em>0.375</em> </li> </ul> <p> Done. </p> <p> Manually updated the module on production. Profile did not need updating. </p> Ticket ed Fri, 03 Oct 2014 12:01:44 GMT http://localhost:8080/trac/ticket/789#comment:3 http://localhost:8080/trac/ticket/789#comment:3 <ul> <li><strong>milestone</strong> set to <em>Maintenance</em> </li> </ul> Ticket ed Fri, 03 Oct 2014 12:02:10 GMT http://localhost:8080/trac/ticket/789#comment:4 http://localhost:8080/trac/ticket/789#comment:4 <p> changed to maintenance milestone for monthly tally </p> Ticket