DRUPAL-CONTRIB-2023-020

DRUPAL-CONTRIB-2023-020

Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.

This module enables you to define a 'weekly office hours' field type, and add a field to any Content type, in order to display the weekly opening hours for a location. The module doesn't sufficiently filter user-supplied text leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker needs additional permissions. The vulnerability can be exploited by an attacker with a role with the permission "administer display" regardless of other configurations. In some scenarios, the vulnerability can be exploited by a user with "Create content" or "Edit content" for a relevant Content type.

Korrektur verfügbar

Veröffentlicht

2023-06-14T14:52:36Z

Aktualisiert

2026-09-10T03:46:03.837384089Z

Technologie-Stack: php

Prüfen Sie Ihren Server →