DRUPAL-CONTRIB-2022-046 The Lottiefiles Field module enables you to integrate the lottiefiles features into your page.
An attacker with content creation permissions can inject malicious scripts via Lottiefiles fields, leading to Cross-Site Scripting attacks against other users.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is DRUPAL-CONTRIB-2022-046?
DRUPAL-CONTRIB-2022-046 is a cross-site scripting vulnerability in drupal/lottiefiles_field, published on 29 Jun 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The Lottiefiles Field module enables you to integrate the lottiefiles features into your page.
The module does not sufficiently filter user-provided text on output, resulting in a Cross-Site Scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create or edit content that has lottiefiles fields.
Which versions are affected by DRUPAL-CONTRIB-2022-046?
Linux distribution packages (1)
drupal/lottiefiles_field Packagist:https://packages.drupal.org/8 | All versions | 1.0.3 |
How do I fix DRUPAL-CONTRIB-2022-046?
Upgrade to a fixed version.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is DRUPAL-CONTRIB-2022-046 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2022-046 in the wild and no public exploit code.