Project: 
Easy Breadcrumb
Date: 
2019-June-19
Security risk: 
Critical 18∕25 AC:Basic/A:None/CI:Some/II:Some/E:Exploit/TD:Default
Vulnerability: 
Cross Site Scripting
Description: 

This module enables you to use the current URL (path alias) and the current page's title to automatically extract the breadcrumb's segments and its respective links then show them as breadcrumbs on your website.

The module doesn't sufficiently sanitise user input in certain circumstances.

This vulnerability does not require any permissions but can be mitigated by un-checking the 'Allow HTML tags in breadcrumb text' setting (enabled by default). In some cases browsers' built-in XSS protection may prevent exploitation.

Edited 2019-Jun-20: updated risk calculation to reflect an oversight in the original advisory. The issue has been exploited.

Solution: 

Install the latest version:

Also see the Easy Breadcrumb project page.

Reported By: 
Fixed By: 
Coordinated By: