CVE-2015-7980

Vulnerability

The Compass Rose module for Drupal 6.x, versions prior to 6.x-1.1, contains a Cross-Site Scripting (XSS) vulnerability. The module embeds a JavaScript library from an external source that was not reliable, allowing injection of arbitrary web script or HTML via unspecified vectors [3]. The vulnerability resides in the module's approach to loading external JavaScript, not in the jQueryRotate library itself [1].

Exploitation

An attacker can exploit this vulnerability by convincing a user to visit a page that uses the affected Compass Rose field, which triggers the untrusted external JavaScript library. The attack does not require authentication or special network position; the attacker only needs to craft a link or content that, when viewed by a victim, executes the injected script in the context of the victim's browser session [3].

Impact

Successful exploitation leads to arbitrary web script or HTML execution in the victim's browser. This can result in session theft, page defacement, or other client-side attacks, potentially compromising the victim's account or exposing sensitive information. The impact is limited to the browser session and does not directly affect server-side data [3].

Mitigation

The vulnerability is fixed in Compass Rose 6.x-1.1, released on August 4, 2015 [4]. Users should upgrade to this version immediately. No other workarounds are documented. The module is unsupported beyond this release [4].