View online: https://www.drupal.org/sa-contrib-2019-042
Project: Module Filter [1] Version: 7.x-2.x-dev Date: 2019-March-27 Security risk: *Moderately critical* 12∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross site scripting
Description: This module enables you to filter the list of modules on the admin modules page, and organizes packages into vertical tabs.
The module doesn't sufficiently escape HTML under the scenario leading to a Cross Site Scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that the attacker must have access to input filtered html that will be included on the modules administration page e.g. in a block (this configuration is not common). Further, the Module Filter vertical tabs setting must be enabled.
Solution: Install the latest version:
* If you use the Module Filter module for Drupal 7.x, upgrade to Module Filter 7.x-2.2 [3]
Also see the Module Filter [4] project page.
Reported By: * Yonatan Offek [5]
Fixed By: * greenSkin [6]
Coordinated By: * Greg Knaddison [7] of the Drupal Security Team
[1] https://www.drupal.org/project/module_filter [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/module_filter/releases/7.x-2.2 [4] https://www.drupal.org/project/module_filter [5] https://www.drupal.org/user/194009 [6] https://www.drupal.org/user/173855 [7] https://www.drupal.org/user/36762