DRUPAL-CONTRIB-2023-044
DRUPAL-CONTRIB-2023-044
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Webprofiler module provides a way of displaying the Symfony profile debugging tool at the bottom of each page. The abbr\_class Twig filter can be used to bypass the Twig auto-escape feature. This vulnerability is mitigated by the fact that it is only exposed when the filter is specifically used in a theme to render content that contains an attack vector.
Fix available
- Published
- Updated
Stack: php
Affected products and versions
drupal/webprofiler Packagist:https://packages.drupal.org/8
- Affected ranges
- ECOSYSTEM: ≥ 10.1.0, < 10.1.1
Update to 10.1.1