DRUPAL-CONTRIB-2023-016 The Iubenda Integration module provides a custom block to provide a link to the Iubenda privacy policy.
Privileged users can inject scripts into Iubenda privacy policy blocks, leading to Cross-Site Scripting attacks against site visitors.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is DRUPAL-CONTRIB-2023-016?
DRUPAL-CONTRIB-2023-016 is a cross-site scripting vulnerability in drupal/iubenda_integration, published on 31 May 2023. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
The Iubenda Integration module provides a custom block to provide a link to the Iubenda privacy policy. On this block, a custom prefix and suffix text can be entered.
The module does not sufficiently filter the block text fields on output, resulting in a Cross-Site Scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with permission to use the layout builder on content, edit the layout, or with the "Administer blocks" permission.
Which versions are affected by DRUPAL-CONTRIB-2023-016?
Linux distribution packages (1)
drupal/iubenda_integration Packagist:https://packages.drupal.org/8 | All versions | 4.0.1 |
How do I fix DRUPAL-CONTRIB-2023-016?
Upgrade to a fixed version.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is DRUPAL-CONTRIB-2023-016 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2023-016 in the wild and no public exploit code.