DRUPAL-CONTRIB-2022-035 Doubleclick for Publishers (DFP) module enables a site to place ads from Doubleclick For Publishers.
An attacker with DFP admin permissions can inject scripts to target site visitors and admins, potentially leading to account takeover.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is DRUPAL-CONTRIB-2022-035?
DRUPAL-CONTRIB-2022-035 is a cross-site scripting vulnerability in drupal/dfp, published on 4 May 2022. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Doubleclick for Publishers (DFP) module enables a site to place ads from Doubleclick For Publishers.
The module doesn't sanitize user input in certain cases, which leads to Cross-Site-Scripting (XSS) vulnerabilities. An attacker that can create or edit certain entities may be able to exploit a Cross-Site-Scripting (XSS) vulnerability to target visitors of the site, including site admins with privileged access.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer DFP".
Which versions are affected by DRUPAL-CONTRIB-2022-035?
Linux distribution packages (1)
drupal/dfp Packagist:https://packages.drupal.org/8 | All versions | 1.2.0 |
How do I fix DRUPAL-CONTRIB-2022-035?
Upgrade to a fixed version.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is DRUPAL-CONTRIB-2022-035 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2022-035 in the wild and no public exploit code.