DRUPAL-CONTRIB-2023-020

DRUPAL-CONTRIB-2023-020

Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.

This module enables you to define a 'weekly office hours' field type, and add a field to any Content type, in order to display the weekly opening hours for a location. The module doesn't sufficiently filter user-supplied text leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker needs additional permissions. The vulnerability can be exploited by an attacker with a role with the permission "administer display" regardless of other configurations. In some scenarios, the vulnerability can be exploited by a user with "Create content" or "Edit content" for a relevant Content type.

Corrección disponible

Publicación

2023-06-14T14:52:36Z

Actualización

2026-09-10T03:46:03.837384089Z

Pila tecnológica: php

Comprueba tu servidor →