Project: 
Iubenda Integration
Date: 
2023-May-31
Security risk: 
Moderately critical 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability: 
Cross Site Scripting
Affected versions: 
<4.0.1
Description: 

The Iubenda Integration module provides a custom block to provide a link to the Iubenda privacy policy. On this block, a custom prefix and suffix text can be entered.

The module does not sufficiently filter the block text fields on output, resulting in a Cross-Site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to use the layout builder on content, edit the layout, or with the "Administer blocks" permission.

Solution: 

Install the latest version:

Reported By: 
Fixed By: 
Coordinated By: