CIVI-SA-2018-05: Reflected XSS in Contact Merge Screen

Pubblicato
2018-07-18 09:00
Written by

In the contact dedupe screen, data retrieved about the contacts was not properly sanitised.

Security Risk
Critical
Vulnerability
Cross Site Scripting
Affected Versions

CiviCRM versions 5.3.0 and 4.6.37 (and earlier)

 

Fixed Versions

CiviCRM version 5.3.1 and 4.6.38 (and later)

 

Solutions

Upgrade to the latest version of CiviCRM

Credits

Patrick Figel of Greenpeace for reporting the issue.

Eileen McNaugton of Wikimedia Foundation for fixing the issue.

References

security/core#6