Published
2015-08-19 05:01
This release addresses an issue where it was possible to deliver XSS by directing a user to a CiviCRM URL which triggered a fatal error. The issue has been addressed by correctly escaping output from CiviCRM's fatal error handler.
For more information about this type of vulnerability, see OWASP's page on Cross Site Scripting.
Security Risk
Moderately Critical
Vulnerability
Cross Site Scripting
Affected Versions
CiviCRM before v4.6.6
CiviCRM LTS before v4.4.18
Fixed Versions
CiviCRM v4.6.7
CiviCRM LTS v4.4.19
Solutions
Either:
- Upgrade to a fixed release of CiviCRM, or
- Patch with https://github.com/civicrm/civicrm-core/commit/0ac9fd523d8a15cf512680861f5a1c57d0097bce
Credits
Thanks to the HP Fortify Open Source Review Project for reporting this issue.
