Bug 1205122 - drupal webform: multiple XSS flaws
Summary: drupal webform: multiple XSS flaws
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1205125 1205126
Blocks:
TreeView+ depends on / blocked
 
Reported: 2015-03-24 10:00 UTC by Martin Prpič
Modified: 2019-09-29 13:30 UTC (History)
2 users (show)

Fixed In Version: Webform 6.x-3.23, Webform 7.x-3.23, Webform 7.x-4.5
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2015-04-23 07:03:51 UTC
Embargoed:

Attachments (Terms of Use)

Description Martin Prpič 2015-03-24 10:00:23 UTC 
Multiple Cross-Site Scripting (XSS) flaws were discovered in the Webform Drupal module:

SA-CONTRIB-2015-063 - Webform - XSS related to Webform Submissions
SA-CONTRIB-2015-063 - Webform - XSS related to Blocks
https://www.drupal.org/node/2445935

SA-CONTRIB-2015-078 - Webform - XSS related to Webform Components
https://www.drupal.org/node/2454903

These issues are resolved in versions: Webform 6.x-3.23, Webform 7.x-3.23, Webform 7.x-4.5
Comment 1 Martin Prpič 2015-03-24 10:02:21 UTC 
Created drupal7-webform tracking bugs for this issue:

Affects: fedora-all [bug 1205125]
Affects: epel-6 [bug 1205126]
Comment 2 Fedora Update System 2015-04-09 09:10:09 UTC 
drupal7-webform-4.7-1.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 3 Fedora Update System 2015-04-09 09:14:52 UTC 
drupal7-webform-4.7-1.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 4 Fedora Update System 2015-04-20 18:37:57 UTC 
drupal7-webform-4.7-1.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 5 Fedora Update System 2015-04-21 19:01:48 UTC 
drupal7-webform-4.7-1.fc22 has been pushed to the Fedora 22 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 6 Peter Borsa 2015-04-23 06:21:37 UTC 
Hi Martin!

Can we close this issue because the updated modules are in stable repositories?
Comment 7 Martin Prpič 2015-04-23 07:03:51 UTC 
(In reply to Peter Borsa from comment #6)
> Hi Martin!
> 
> Can we close this issue because the updated modules are in stable
> repositories?

Definitely!
Note You need to log in before you can comment on or make changes to this bug.