http://localhost:8080/trac/ticket/792 <p> View online: <a class="ext-link" href="https://www.drupal.org/node/2344369"><span class="icon">​</span>https://www.drupal.org/node/2344369</a> </p> <ul><li>Advisory ID: DRUPAL-SA-CONTRIB-2014-094 </li><li>Project: Webform Patched <a class="missing changeset" title="No default repository defined">[1]</a> (third-party module) </li><li>Version: 6.x, 7.x </li><li>Date: 2014-September-24 </li><li>Security risk: 13/25 ( Moderately Critical) </li></ul><p> AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default <a class="missing changeset" title="No default repository defined">[2]</a> </p> <ul><li>Vulnerability: Cross Site Scripting </li></ul><hr /> <hr /> <p> The Webform Patched module is a fork of the Webform module with Token support added. The module enables you to create forms which can be used for surveys, contact forms or other data collection throughout your site. </p> <p> The module doesn't sufficiently sanitize field label titles when two fields have the same form_key, which can only be managed by carefully crafting the webform structure via a specific set of circumstances. </p> <p> This vulnerability is mitigated by the fact that an attacker must have a role with the permission "create webform content". </p> <hr /> <hr /> <ul><li>/A CVE identifier <a class="missing changeset" title="No default repository defined">[3]</a> will be requested, and added upon issuance, in </li></ul><p> accordance with Drupal Security Team processes./ </p> <hr /> <hr /> <ul><li>Webform Patched 6.x-3.x versions prior to 6.x-3.20. </li><li>Webform Patched 7.x-3.x versions prior to 7.x-3.20. </li></ul><p> Drupal core is not affected. If you do not use the contributed Webform Patched <a class="missing changeset" title="No default repository defined">[4]</a> module, there is nothing you need to do. </p> <hr /> <hr /> <p> Install the latest version: </p> <ul><li>If you use the webform module for Drupal 6.x, upgrade to webform_patched </li></ul><p> 6.x-3.20 <a class="missing changeset" title="No default repository defined">[5]</a> </p> <ul><li>If you use the webform module for Drupal 7.x-3.x, upgrade to </li></ul><p> webform_patched 7.x-3.20 <a class="missing changeset" title="No default repository defined">[6]</a> </p> <p> Also see the Webform Patched <a class="missing changeset" title="No default repository defined">[7]</a> project page. </p> <hr /> <hr /> <ul><li>Maurits Lawende <a class="missing changeset" title="No default repository defined">[8]</a> </li><li>Matt Vance <a class="missing changeset" title="No default repository defined">[9]</a> </li></ul><hr /> <hr /> <ul><li>Nate Haug <a class="missing changeset" title="No default repository defined">[10]</a> the module maintainer </li></ul><hr /> <hr /> <ul><li>Greg Knaddison <a class="missing changeset" title="No default repository defined">[11]</a>, Dan Smith <a class="missing changeset" title="No default repository defined">[12]</a> and Lee Rowlands <a class="missing changeset" title="No default repository defined">[13]</a> of the Drupal </li></ul><p> Security Team </p> <hr /> <hr /> <p> The Drupal security team can be reached at security at drupal.org or via the contact form at <a class="ext-link" href="https://www.drupal.org/contact"><span class="icon">​</span>https://www.drupal.org/contact</a> <a class="missing changeset" title="No default repository defined">[14]</a>. </p> <p> Learn more about the Drupal Security team and their policies <a class="missing changeset" title="No default repository defined">[15]</a>, writing secure code for Drupal <a class="missing changeset" title="No default repository defined">[16]</a>, and securing your site <a class="missing changeset" title="No default repository defined">[17]</a>. </p> <p> <a class="missing changeset" title="No default repository defined">[1]</a> <a class="ext-link" href="https://www.drupal.org/project/webform_patched"><span class="icon">​</span>https://www.drupal.org/project/webform_patched</a> <a class="missing changeset" title="No default repository defined">[2]</a> <a class="ext-link" href="https://www.drupal.org/security-team/risk-levels"><span class="icon">​</span>https://www.drupal.org/security-team/risk-levels</a> <a class="missing changeset" title="No default repository defined">[3]</a> <a class="ext-link" href="http://cve.mitre.org/"><span class="icon">​</span>http://cve.mitre.org/</a> <a class="missing changeset" title="No default repository defined">[4]</a> <a class="ext-link" href="https://www.drupal.org/project/webform_patched"><span class="icon">​</span>https://www.drupal.org/project/webform_patched</a> <a class="missing changeset" title="No default repository defined">[5]</a> <a class="ext-link" href="http://drupal.org/node/2241675"><span class="icon">​</span>http://drupal.org/node/2241675</a> <a class="missing changeset" title="No default repository defined">[6]</a> <a class="ext-link" href="http://drupal.org/node/2241685"><span class="icon">​</span>http://drupal.org/node/2241685</a> <a class="missing changeset" title="No default repository defined">[7]</a> <a class="ext-link" href="https://www.drupal.org/project/webform_patched"><span class="icon">​</span>https://www.drupal.org/project/webform_patched</a> <a class="missing changeset" title="No default repository defined">[8]</a> <a class="ext-link" href="http://drupal.org/user/243897"><span class="icon">​</span>http://drupal.org/user/243897</a> <a class="missing changeset" title="No default repository defined">[9]</a> <a class="ext-link" href="https://www.drupal.org/user/10269"><span class="icon">​</span>https://www.drupal.org/user/10269</a> <a class="missing changeset" title="No default repository defined">[10]</a> <a class="ext-link" href="http://drupal.org/user/35821"><span class="icon">​</span>http://drupal.org/user/35821</a> <a class="missing changeset" title="No default repository defined">[11]</a> <a class="ext-link" href="http://drupal.org/user/36762"><span class="icon">​</span>http://drupal.org/user/36762</a> <a class="missing changeset" title="No default repository defined">[12]</a> <a class="ext-link" href="http://drupal.org/user/241220"><span class="icon">​</span>http://drupal.org/user/241220</a> <a class="missing changeset" title="No default repository defined">[13]</a> <a class="ext-link" href="https://drupal.org/user/395439"><span class="icon">​</span>https://drupal.org/user/395439</a> <a class="missing changeset" title="No default repository defined">[14]</a> <a class="ext-link" href="https://www.drupal.org/contact"><span class="icon">​</span>https://www.drupal.org/contact</a> <a class="missing changeset" title="No default repository defined">[15]</a> <a class="ext-link" href="https://www.drupal.org/security-team"><span class="icon">​</span>https://www.drupal.org/security-team</a> <a class="missing changeset" title="No default repository defined">[16]</a> <a class="ext-link" href="https://www.drupal.org/writing-secure-code"><span class="icon">​</span>https://www.drupal.org/writing-secure-code</a> <a class="missing changeset" title="No default repository defined">[17]</a> <a class="ext-link" href="https://www.drupal.org/security/secure-configuration"><span class="icon">​</span>https://www.drupal.org/security/secure-configuration</a> </p> en-us /trac/chrome/site/TransitionNetwork-Logo-Web-Small.jpg http://localhost:8080/trac/ticket/792 Trac 0.12.5 paul Mon, 29 Sep 2014 09:29:48 GMT http://localhost:8080/trac/ticket/792#comment:1 http://localhost:8080/trac/ticket/792#comment:1 <ul> <li><strong>hours</strong> changed from <em>0.0</em> to <em>0.25</em> </li> <li><strong>totalhours</strong> changed from <em>0.0</em> to <em>0.25</em> </li> </ul> <p> @Chris </p> <p> My stage site is not loading. Would you investigate. Thanks. </p> <p> <a class="ext-link" href="https://booker-stage-20140717.transitionnetwork.org"><span class="icon">​</span>https://booker-stage-20140717.transitionnetwork.org</a> </p> Ticket paul Mon, 29 Sep 2014 09:31:15 GMT http://localhost:8080/trac/ticket/792#comment:2 http://localhost:8080/trac/ticket/792#comment:2 <p> Sorry, it just seems to be the update page. I'll have another look .. </p> <p> <a class="ext-link" href="https://booker-stage-20140717.transitionnetwork.org/admin/reports/updates"><span class="icon">​</span>https://booker-stage-20140717.transitionnetwork.org/admin/reports/updates</a> </p> Ticket paul Mon, 29 Sep 2014 09:48:33 GMT http://localhost:8080/trac/ticket/792#comment:3 http://localhost:8080/trac/ticket/792#comment:3 <ul> <li><strong>hours</strong> changed from <em>0.0</em> to <em>0.25</em> </li> <li><strong>totalhours</strong> changed from <em>0.25</em> to <em>0.5</em> </li> </ul> <p> Production updated. </p> Ticket chris Mon, 29 Sep 2014 09:59:30 GMT http://localhost:8080/trac/ticket/792#comment:4 http://localhost:8080/trac/ticket/792#comment:4 <ul> <li><strong>cc</strong> <em>chris</em> added </li> <li><strong>hours</strong> <em>0</em> deleted </li> <li><strong>milestone</strong> set to <em>Maintenance</em> </li> </ul> <p> Replying to <a href="http://localhost:8080/trac/ticket/792#comment:1" title="Comment 1 for Ticket #792">paul</a>: </p> <blockquote class="citation"> <p> @Chris </p> <p> My stage site is not loading. Would you investigate. Thanks. </p> <p> <a class="ext-link" href="https://booker-stage-20140717.transitionnetwork.org"><span class="icon">​</span>https://booker-stage-20140717.transitionnetwork.org</a> </p> </blockquote> <p> Hi, I only came across this ticket by looking at the timeline -- you need to add <tt>chris</tt> to the Cc box to copy tickets to me if you want me to get them by email! </p> <p> In any case the site appears to be working OK now? </p> Ticket chris Mon, 29 Sep 2014 10:00:55 GMT http://localhost:8080/trac/ticket/792#comment:5 http://localhost:8080/trac/ticket/792#comment:5 <ul> <li><strong>component</strong> changed from <em>Live server</em> to <em>Drupal modules & settings</em> </li> </ul> Ticket paul Mon, 29 Sep 2014 10:15:23 GMT http://localhost:8080/trac/ticket/792#comment:6 http://localhost:8080/trac/ticket/792#comment:6 <ul> <li><strong>hours</strong> changed from <em>0.0</em> to <em>0.125</em> </li> <li><strong>totalhours</strong> changed from <em>0.5</em> to <em>0.625</em> </li> </ul> <p> Roger that. </p> <p> The problem was just that the update module was disabled on my stage site. I have enabled updates and database logging. All good. </p> Ticket