DRUPAL-CONTRIB-2023-042 This module enables you to hide email addresses from bots and site scrapers by using the rot13 strategy.
An attacker with specific content permissions can inject malicious scripts via unescaped data attributes, bypassing email obfuscation protections.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is DRUPAL-CONTRIB-2023-042?
DRUPAL-CONTRIB-2023-042 is a cross-site scripting vulnerability in drupal/obfuscate_email, published on 30 Aug 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
This module enables you to hide email addresses from bots and site scrapers by using the rot13 strategy.
The module doesn't sufficiently escape the data attribute under the scenario a user has access to manipulate that value.
This vulnerability is mitigated by the fact that an attacker must have a role with permissions to allow data attributes in content on a site.
Which versions are affected by DRUPAL-CONTRIB-2023-042?
Linux distribution packages (1)
drupal/obfuscate_email Packagist:https://packages.drupal.org/8 | All versions | 2.0.1 |
How do I fix DRUPAL-CONTRIB-2023-042?
Upgrade to a fixed version.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is DRUPAL-CONTRIB-2023-042 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2023-042 in the wild and no public exploit code.