DRUPAL-CONTRIB-2022-024 The Custom Breadcrumbs module provides a variety of options for customizing the breadcrumb trail.
An attacker with admin permissions can inject malicious scripts into breadcrumb trails, potentially compromising user sessions.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is DRUPAL-CONTRIB-2022-024?
DRUPAL-CONTRIB-2022-024 is a cross-site scripting vulnerability in drupal/custom_breadcrumbs, published on 9 Feb 2022. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
The Custom Breadcrumbs module provides a variety of options for customizing the breadcrumb trail.
The module doesn't sufficiently filter on output, leading to a Cross Site Scripting vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer custom breadcrumbs" permission.
Which versions are affected by DRUPAL-CONTRIB-2022-024?
Linux distribution packages (1)
drupal/custom_breadcrumbs Packagist:https://packages.drupal.org/8 | All versions | 1.0.1 |
How do I fix DRUPAL-CONTRIB-2022-024?
Upgrade to a fixed version.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is DRUPAL-CONTRIB-2022-024 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2022-024 in the wild and no public exploit code.