View online: https://www.drupal.org/sa-contrib-2017-093
Project: Panopoly Core [1] Version: 7.x-1.x-dev Date: 2017-December-13 Security risk: *Moderately critical* 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Scripting
Description: This module provides common functionality used by other modules in the Panopoly distribution and child distributions, like, Open Atrium.
The module doesn't sufficiently filter node titles used in breadcrumbs when the "Append Page Title to Site Breadcrumb" setting is enabled.
This vulnerability is mitigated by the fact that an attacker must have a role with the ability to create content.
Solution: Install the latest version:
* If you use the Panopoly Core module for Drupal 7.x, upgrade to Panopoly Core 7.x-1.49 [3]
Reported By: * Brian Osborne [4]
Fixed By: * David Snopek [5] the module maintainer * Brian Osborne [6]
Coordinated By: * David Snopek [7] of the Drupal Security Team
[1] https://www.drupal.org/project/panopoly_core [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/panopoly_core/releases/7.x-1.49 [4] https://www.drupal.org/user/788032 [5] https://www.drupal.org/user/266527 [6] https://www.drupal.org/user/788032 [7] https://www.drupal.org/user/266527