=====================================================================

                           CERT-Renater

               Note d'Information No. 2013/VULN238
_____________________________________________________________________

DATE                : 14/06/2013

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S) : Systems running
                         Display Suite for DRUPAL versions prior to 7.x.

======================================================================
https://drupal.org/node/2017933
______________________________________________________________________

SA-CONTRIB-2013-052 - Display Suite - Cross Site Scripting (XSS)
Posted by Drupal Security Team on June 12, 2013 at 3:34pm

    Advisory ID: DRUPAL-SA-CONTRIB-2013-052
    Project: Display Suite (third-party module)
    Version: 7.x
    Date: 2013-June-12
    Security risk: Moderately critical
    Exploitable from: Remote
    Vulnerability: Cross Site Scripting


Description

Display Suite allows you to take full control over how your content is
displayed using a drag and drop interface.

In certain situations, Display Suite does not properly sanitize entity
bundle labels, allowing a malicious user to embed scripts within a
page, resulting in a Cross-site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker has to be
able to create entity bundle labels of some sort, which usually needs a
higher level permission such as administer taxonomy.

CVE identifier(s) issued

    A CVE identifier will be requested, and added upon issuance, in
accordance with Drupal Security Team processes.


Versions affected

    Display Suite 7.x-1.x versions prior to 7.x-1.7.
    Display Suite 7.x-2.x versions prior to 7.x-2.3.

Drupal core is not affected. If you do not use the contributed Display
Suite module, there is nothing you need to do.
Solution

Install the latest version:

    If you use the first branch of Display Suite module for Drupal 7.x,
upgrade to Display Suite 7.x-1.8
    If you use the second branch of Display Suite module for Drupal
7.x, upgrade to Display Suite 7.x-2.4

Also see the Display Suite project page.


Reported by

    Francisco José Cruz Romanos


Fixed by

    Francisco José Cruz Romanos
    Kristof De Jaeger the module maintainer


Coordinated by

    Klaus Purer of the Drupal Security Team


Contact and More Information

The Drupal security team can be reached at security at drupal.org or
via the contact form at http://drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing
secure code for Drupal, and securing your site.


Categories: Drupal 7.x


======================================================================

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
==========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44           +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41           +
+ 75013 Paris           | email: cert@support.renater.fr +
==========================================================