Project:
Project machine name:
dynamic_bannerDate:
2018-February-14
Vulnerability:
Cross site scripting
Description:
This module enables a site to display different banners (via blocks) on different pages depending upon specific criteria.
The module doesn't sufficiently filter output of banner data.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer dynamic_banner".
Solution:
Install the latest version:
- If you use the Dynamic Banner module for Drupal 7.x, upgrade to Dynamic Banner 7.x-1.1
Reported By:
- Balazs Janos Tatar Provisional Security Team Member
Fixed By:
Coordinated By:
- Michael Hess of the Drupal Security Team
