Drupal Display Suite Module Cross Site Scripting Vulnerability

Bugtraq ID:	98540
Class:	Input Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	May 18 2017 12:00AM
Updated:	May 18 2017 12:00AM
Credit:	Sascha Grossenbacher and Bram Goffings
Vulnerable:	Drupal Display Suite 8.x-3.0-beta2 Drupal Display Suite 8.x-3.0-beta1 Drupal Display Suite 8.x-2.6 Drupal Display Suite 8.x-2.5 Drupal Display Suite 8.x-2.4 Drupal Display Suite 8.x-2.3 Drupal Display Suite 8.x-2.2 Drupal Display Suite 8.x-2.1 Drupal Display Suite 8.x-2.0
Not Vulnerable:	Drupal Display Suite 8.x-3.0 Drupal Display Suite 8.x-2.7

Drupal Display Suite Module Cross Site Scripting Vulnerability

The Display Suite module for Drupal is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Display Suite 8.x-2.x versions prior to 8.x-2.7 and 8.x-3.x versions prior to 8.x-3.0 are vulnerable.

Drupal Display Suite Module Cross Site Scripting Vulnerability

To exploit this issue an attacker must entice an unsuspecting victim to open a malicious URI.

Drupal Display Suite Module Cross Site Scripting Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Drupal Display Suite Module Cross Site Scripting Vulnerability

References:

• Drupal Homepage (Drupal)
  
• DRUPAL-SA-CONTRIB-2017-049: Display Suite - Moderately Critical - Cross Site Scr (Drupal)