DRUPAL-CONTRIB-2023-020

DRUPAL-CONTRIB-2023-020

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

This module enables you to define a 'weekly office hours' field type, and add a field to any Content type, in order to display the weekly opening hours for a location. The module doesn't sufficiently filter user-supplied text leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker needs additional permissions. The vulnerability can be exploited by an attacker with a role with the permission "administer display" regardless of other configurations. In some scenarios, the vulnerability can be exploited by a user with "Create content" or "Edit content" for a relevant Content type.

Correctif disponible

Publication

2023-06-14T14:52:36Z

Mise à jour

2026-09-10T03:46:03.837384089Z

Pile logicielle: php

Vérifiez votre serveur →