DRUPAL-CONTRIB-2023-044
DRUPAL-CONTRIB-2023-044
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
The Webprofiler module provides a way of displaying the Symfony profile debugging tool at the bottom of each page. The abbr\_class Twig filter can be used to bypass the Twig auto-escape feature. This vulnerability is mitigated by the fact that it is only exposed when the filter is specifically used in a theme to render content that contains an attack vector.
Correctif disponible
- Publication
- Mise à jour
Pile logicielle: php
Produits et versions concernés
drupal/webprofiler Packagist:https://packages.drupal.org/8
- Plages de versions concernées
- ECOSYSTEM: ≥ 10.1.0, < 10.1.1
Mettez à jour vers 10.1.1