Security Risk: 
Cross Site Scripting
Affected Versions: 

CiviCRM v4.3 - v4.6

Fixed Versions: 

CiviCRM v4.4.20, v4.6.10

Publication Date: 
Wednesday, November 4, 2015

This release addresses an issue where it was possible to deliver XSS by directing a user to a CiviCRM URL which triggered a fatal error. The issue has been addressed by correctly escaping output from CiviCRM's fatal error handler.

For more information about this type of vulnerability, see OWASP's page on Cross Site Scripting.



Any ONE of the following:

  • Upgrade to CiviCRM v4.4.20+ or v4.6.10+
  • Apply change ed6a28a1.
  • Marcin Piosek

  • Tim Otten (CiviCRM)

  • Eileen McNaughton (Fuzion)