DRUPAL-CONTRIB-2019-092 The Smart Trim module allows site builders additional control with text summary fields.
Authenticated users with content creation rights can inject scripts via insufficient filtering in the Smart Trim module when specific options are enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is DRUPAL-CONTRIB-2019-092?
DRUPAL-CONTRIB-2019-092 is a cross-site scripting vulnerability in drupal/smart_trim, published on 11 Dec 2019. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Smart Trim module allows site builders additional control with text summary fields.
The module doesn't sufficiently filter text when certain options are selected.
This vulnerability is mitigated by the fact that an attacker must have a role with the ability to create content on the site when certain options are selected for the trimmed output.
Which versions are affected by DRUPAL-CONTRIB-2019-092?
Linux distribution packages (1)
drupal/smart_trim Packagist:https://packages.drupal.org/8 | All versions | 1.2.0 |
How do I fix DRUPAL-CONTRIB-2019-092?
Upgrade to a fixed version.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is DRUPAL-CONTRIB-2019-092 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2019-092 in the wild and no public exploit code.