Project:
Date:
2023-August-30
Vulnerability:
Cross Site Scripting
Affected versions:
<2.0.1
Description:
This module enables you to hide email addresses from bots and site scrapers by using the rot13 strategy.
The module doesn't sufficiently escape the data attribute under the scenario a user has access to manipulate that value.
This vulnerability is mitigated by the fact that an attacker must have a role with permissions to allow data attributes in content on a site.
Solution:
Install the latest version:
- If you use the Obfuscate Email module for Drupal 2.0.0, upgrade to Obfuscate Email 2.0.1
Reported By:
Fixed By:
Coordinated By:
- cilefen of the Drupal Security Team
- Damien McKenna of the Drupal Security Team
- Greg Knaddison of the Drupal Security Team
