DRUPAL-CONTRIB-2022-026 This module provides an entity relationship hierarchy tree widget for an entity reference field.
An attacker with entity modification permissions can inject scripts via the hierarchy widget, potentially stealing data or hijacking sessions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is DRUPAL-CONTRIB-2022-026?
DRUPAL-CONTRIB-2022-026 is a cross-site scripting vulnerability in drupal/entity_reference_tree, published on 23 Feb 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
This module provides an entity relationship hierarchy tree widget for an entity reference field.
The module doesn't sufficiently filter on output, leading to a Cross Site Scripting vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission to modify an entity that is the reference to a field.
Which versions are affected by DRUPAL-CONTRIB-2022-026?
Linux distribution packages (1)
drupal/entity_reference_tree Packagist:https://packages.drupal.org/8 | All versions | 2.0.2 |
How do I fix DRUPAL-CONTRIB-2022-026?
Upgrade to a fixed version.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is DRUPAL-CONTRIB-2022-026 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2022-026 in the wild and no public exploit code.