Security Risk: 
Moderately Critical
Cross Site Scripting
Affected Versions: 

CiviCRM before v4.6.6

CiviCRM LTS before v4.4.18

Fixed Versions: 

CiviCRM v4.6.7

CiviCRM LTS v4.4.19

Publication Date: 
Wednesday, August 19, 2015

This release addresses an issue where it was possible to deliver XSS by directing a user to a CiviCRM URL which triggered a fatal error. The issue has been addressed by correctly escaping output from CiviCRM's fatal error handler.

For more information about this type of vulnerability, see OWASP's page on Cross Site Scripting.




Thanks to the HP Fortify Open Source Review Project for reporting this issue.