View online: https://www.drupal.org/sa-contrib-2020-005
Project: SVG Formatter [1] Date: 2020-March-04 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Cross site scripting
Description: SVG Formatter module provides support for using SVG images on your website.
This security release fixes third-party dependencies included in or required by SVG Formatter. XSS bypass using entities and tab [3].
This vulnerability is mitigated by the fact that an attacker must be able to upload SVG files.
Solution: Install the latest version:
* If you use the SVG Formatter module for Drupal 8.x, upgrade to SVG Formatter 8.x-1.12 [4]
Also see the SVG Formatter [5] project page.
Reported By: * Jeroen Tubex [6]
Fixed By: * Goran Nikolovski [7]
Coordinated By: * Greg Knaddison [8] of the Drupal Security Team
[1] https://www.drupal.org/project/svg_formatter [2] https://www.drupal.org/security-team/risk-levels [3] https://github.com/darylldoyle/svg-sanitizer/issues/31 [4] https://www.drupal.org/project/svg_formatter/releases/8.x-1.12 [5] https://www.drupal.org/project/svg_formatter [6] https://www.drupal.org/user/2228934 [7] https://www.drupal.org/user/3451979 [8] https://www.drupal.org/user/36762