Project: 
Mosaik
Date: 
2017-October-25
Security risk: 
Moderately critical 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default
Vulnerability: 
Cross-site scripting
Description: 

The Mosaik module enables you to create pages or complex blocks in Drupal with the logic of a real mosaic and its pieces.

The module doesn't sufficiently sanitize the titles of fieldsets on its administration pages or the titles of blocks that it creates. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer mosaik".

Solution: 

Install the latest version:

  • If you use the Mosaik module for Drupal 7, upgrade to Mosaik 7.x-1.2

Also see the Mosaik project page.

Reported By: 
Fixed By: 
Coordinated By: