—
DRUPAL-CONTRIB-2024-011
Details
The Coffee module helps you to navigate through the Drupal admin menus faster with a shortcut popup.
The module doesn't sufficiently escape menu names when displaying them in the popup, thereby exposing a XSS vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer menus and menu links".
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist:https://packages.drupal.org/8/drupal/coffee
Introduced in:
0Fixed in: 1.4.0Upgrade drupal/coffee to 1.4.0 or newer (ecosystem packagist:https://packages.drupal.org/8).