—
DRUPAL-CONTRIB-2023-023
Details
This module enables you to define configurable GDPR alert messages.
The module doesn't sufficiently filter user-supplied text leading to a Cross Site Scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker needs additional permissions. The vulnerability can be exploited by an attacker with a role with the permission "administer gdpr alert" regardless of other configurations.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist:https://packages.drupal.org/8/drupal/gdpr_alert
Introduced in:
1.0.0Fixed in: 1.0.1Upgrade drupal/gdpr_alert to 1.0.1 or newer (ecosystem packagist:https://packages.drupal.org/8).