Support for Drupal 7 is ending on 5 January 2025—it’s time to migrate to Drupal 10! Learn about the many benefits of Drupal 10 and find migration tools in our resource center.Project:
Date:
2022-February-23
Vulnerability:
Cross Site Scripting
Affected versions:
<2.0.2
Description:
This module provides an entity relationship hierarchy tree widget for an entity reference field.
The module doesn't sufficiently filter on output, leading to a Cross Site Scripting vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission to modify an entity that is the reference to a field.
Solution:
Install the latest version:
- If you use the Entity Reference Tree Widget module for Drupal 8.x or 9.x, upgrade to entity_reference_tree 2.0.2
Reported By:
Fixed By:
Coordinated By:
- Chris McCafferty of the Drupal Security Team
- Damien McKenna of the Drupal Security Team
