DRUPAL-CONTRIB-2020-002unknown
DRUPAL-CONTRIB-2020-002
No CVE assignedCheck your stack
The advisory, in context
The SpamSpan module obfuscates email addresses to help prevent spambots from collecting them.
This module contains a spamspan twig filter which doesn't sanitize the passed HTML string.
This vulnerability is mitigated by the fact that sites must have custom twig template files that use the SpamSpan filter on a field that an attacker could populate. By default the SpamSpan module does not use the vulnerable twig filter.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
drupal/spamspan Packagist:https://packages.drupal.org/8
Ecosystem versions
From 1.0.0 through 1.0.0 (inclusive)
No fix recorded for this interval.
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"last_affected": "1.0.0"
}
],
"type": "ECOSYSTEM",
"database_specific": {
"constraint": "1.0.0"
}
}
],
"versions": []
}