1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

XenForo 1.3.8 Released (Security Fix)

Discussion in 'Announcements' started by XenForo, Jul 27, 2015.

  1. XenForo

    XenForo Company Info Staff Member

    We have recently become aware of a security issue within XenForo and have released a patch and new version (XenForo 1.3.8) to resolve this issue. We strongly recommend all XenForo customers follow the steps below to resolve this issue.

    The issue is a cross site scripting (XSS) flaw that could allow an attacker to steal cookies or force a user to take actions without their consent or knowledge (possibly including administrative actions).

    If you have any questions relating to installing this patch or upgrading to the new version, please post in the Upgrade Support forum.

    Method 1: Upgrade to the New Version

    You may upgrade to XenForo 1.3.8 to fix this issue. You should upgrade as you would to any other release.

    Customers with an active license may download this version from their customer area. Full details for how to install and upgrade XenForo can be found in the XenForo Manual.

    Method 2: Install the Patch

    Download the patch zip file attached to the end of this message. It contains 4 files:
    • library/XenForo/DataWriter.php
    • library/XenForo/Install/View/ErrorServer.php
    • library/XenForo/ViewAdmin/Error/ServerError.php
    • library/XenForo/ViewPublic/Error/ServerError.php
    These 4 files should be uploaded to your server, overwriting the existing files of the same names.

    Note that with this method there is no outward indication that the patch has been applied. We recommend upgrading if possible.

    Attached Files:

    Alex S, Eagle, Amaury and 3 others like this.

Share This Page