DRUPAL-CONTRIB-2020-027unknown
DRUPAL-CONTRIB-2020-027
No CVE assignedCheck your stack
The advisory, in context
This module enables you to use the current URL (path alias) and the current page's title to automatically extract the breadcrumb's segments and its respective links then show them as breadcrumbs on your website.
The module doesn't sufficiently sanitize editor input in certain circumstances leading to a Cross Site Scripting (XSS) vulnerability.
This vulnerability requires the user have 'administer Easy Breadcrumb settings permission'.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
drupal/easy_breadcrumb Packagist:https://packages.drupal.org/8
Ecosystem versions
Earlier releases before 1.13.0
Fixed in 1.13.0
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.13.0"
}
],
"type": "ECOSYSTEM",
"database_specific": {
"constraint": "<1.13.0"
}
}
],
"versions": []
}