DRUPAL-CONTRIB-2023-017unknown
DRUPAL-CONTRIB-2023-017
No CVE assignedCheck your stack
The advisory, in context
The Consent Popup provides a configurable popup that requires acceptance of a question before the visitor can continue, typically used for age consent.
The module doesn't sufficiently sanitizes the text on the block leading to a cross site scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create blocks.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
drupal/consent_popup Packagist:https://packages.drupal.org/8
Ecosystem versions
Earlier releases before 1.0.3
Fixed in 1.0.3
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.3"
}
],
"type": "ECOSYSTEM",
"database_specific": {
"constraint": "<1.0.3"
}
}
],
"versions": []
}