Date: 
2021-June-02
Vulnerability: 
Cross Site Scripting
Description: 

The Frequently Asked Questions (faq) module allows users, with appropriate permissions, to create question and answer pairs which they want displayed on the 'faq' page. The 'faq' page is automatically generated from the FAQ nodes configured. Basic Views layouts are also provided and can be customised via the Views UI (rather than via the module settings page).

The module doesn't sufficiently sanitize editor input leading to a Cross Site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with the "create faq content" permission.

Solution: 

Install the latest version:

Reported By: 
Fixed By: 
Coordinated By: