{"answers":{"affected":"","exploited":"There is no known exploitation of DRUPAL-CONTRIB-2023-044 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"DRUPAL-CONTRIB-2023-044 is a cross-site scripting vulnerability in drupal/webprofiler, published on 6 Sep 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for DRUPAL-CONTRIB-2023-044 and fix it if it is affected.\n\nWhat it is: DRUPAL-CONTRIB-2023-044 is a cross-site scripting vulnerability in drupal/webprofiler, published on 6 Sep 2023. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of DRUPAL-CONTRIB-2023-044 in the wild and no public exploit code.\n\nAffected product: drupal/webprofiler. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/DRUPAL-CONTRIB-2023-044/ (Markdown: https://insights.sbomify.com/DRUPAL-CONTRIB-2023-044/index.md)","id":"DRUPAL-CONTRIB-2023-044","markdown":"https://insights.sbomify.com/DRUPAL-CONTRIB-2023-044/index.md","name":"DRUPAL-CONTRIB-2023-044","record":{"aliases":[],"analysis":{"component_type":"cms_plugin","fix_type":"upgrade","impacts":["security_bypass"],"network_reachable":"yes","non_default_config":true,"product_category":"Drupal Webprofiler module","requires_auth":"none","summary":"Attackers can bypass Twig auto-escaping to inject scripts if the abbr_class filter is used in a theme, requiring specific theme configuration.","user_interaction":"required","vuln_class":"xss"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The Webprofiler module provides a way of displaying the Symfony profile debugging tool at the bottom of each page.\n\nThe abbr\\_class Twig filter can be used to bypass the Twig auto-escape feature.\n\nThis vulnerability is mitigated by the fact that it is only exposed when the filter is specifically used in a theme to render content that contains an attack vector.","ecosystems":["Packagist:https://packages.drupal.org/8"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"The Webprofiler module provides a way of displaying the Symfony profile debugging tool at the bottom of each page.","id":"DRUPAL-CONTRIB-2023-044","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":null,"product":null,"products":[],"type":"xss","year":"2023"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"Packagist:https://packages.drupal.org/8","fixed":["10.1.1"],"introduced":["10.1.0"],"last_affected":[],"package":"drupal/webprofiler","purl":"pkg:composer/drupal/webprofiler?repository_url=https:%2F%2Fpackages.drupal.org%2F8","source":"DRUPAL-CONTRIB-2023-044"}],"products":null,"published":"2023-09-06","related":[],"sources":[{"class":"attribution","licence":"MIT","name":"Drupal","prefix":"DRUPAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Attackers can bypass Twig auto-escaping to inject scripts if the abbr_class filter is used in a theme, requiring specific theme configuration.","url":"https://insights.sbomify.com/DRUPAL-CONTRIB-2023-044/"}