Security Risk: 
Critical
Vulnerability: 
Cross Site Scripting
Affected Versions: 

CiviCRM Versions prior to 4.7.26 and 4.6.33

Fixed Versions: 

CiviCRM Versions 4.7.26 and 4.6.33

Publication Date: 
Wednesday, November 1, 2017
Description: 

When viewing the list of message templates, one could pass through a variable called selectedChild through the URL which would specify which of the two lists it would default to showing. This variable was not properly validated against the known two types (user  and workflow). There is now proper validation on the url parameter

Solutions: 

Upgrade to the latest CiviCRM Version:

  • 4.7.26
  • 4.6.33

or later

If you cannot upgrade apply the following patch

Credits: 

Sean Madsen of Left Join Labs for reporting the issue

Seamus Lee of Australian Greens for fixing the issue

References: