View online: https://www.drupal.org/sa-contrib-2022-035
Project: Doubleclick for Publishers (DFP) [1] Date: 2022-May-04 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting
Description: Doubleclick for Publishers (DFP) module enables a site to place ads from Doubleclick For Publishers.
The module doesn't sanitize user input in certain cases, which leads to Cross-Site-Scripting (XSS) vulnerabilities. An attacker that can create or edit certain entities may be able to exploit a Cross-Site-Scripting (XSS) vulnerability to target visitors of the site, including site admins with privileged access.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer DFP".
Solution: Install the latest version:
* If you use the Doubleclick for Publishers module for Drupal 9.x, upgrade to DFP 8.x-1.2 [3]
Note that the Drupal 7 version of this module is unaffected.
Reported By: * John Herreño [4]
Fixed By: * John Herreño [5] * Marcelo Vani [6]
Coordinated By: * Lee Rowlands [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team * Damien McKenna [9] of the Drupal Security Team
[1] https://www.drupal.org/project/dfp [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/dfp/releases/8.x-1.2 [4] https://www.drupal.org/user/350711 [5] https://www.drupal.org/user/350711 [6] https://www.drupal.org/user/854220 [7] https://www.drupal.org/user/395439 [8] https://www.drupal.org/user/36762 [9] https://www.drupal.org/user/108450