Project:
Date:
2023-June-28
Vulnerability:
Cross Site Scripting
Affected versions:
<1.4.0
Description:
This module enables you to render a field in an expandable/collapsible region.
The module doesn't sufficiently sanitize the field content when displaying it to an end user.
This vulnerability is mitigated by the fact that an attacker must have a role capable of creating content that uses the field formatter.
Solution:
Install the latest version:
- If you use the Expandable Formatter module for Drupal 8.x, upgrade to Expandable Formatter 8.x-1.4
Reported By:
Fixed By:
- cilefen of the Drupal Security Team
- Kevin Dutra
- Mariusz Andrzejewski
- Mitch Portier
Coordinated By:
- Damien McKenna of the Drupal Security Team
- Greg Knaddison of the Drupal Security Team
- cilefen of the Drupal Security Team
