View online: https://www.drupal.org/sa-contrib-2021-028

Project: Entity Embed [1] Date: 2021-September-15 Security risk: *Moderately critical* 11∕25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Request Forgery

CVE IDs: CVE-2020-13673 Description:  This advisory addresses a similar issue to Drupal core - Moderately critical - Cross Site Request Forgery - SA-CORE-2021-006 [3].

The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to cross-site scripting.

Solution:  Install the latest version:

* If you use the Entity Embed module for Drupal 8 or 9, upgrade to Entity Embed 8.x-1.2 [4].

Drupal 7 versions of Entity Embed do not have a stable release and therefore do not receive security coverage.

Reported By:  * Aaron Zinck [5]

Fixed By:  * Jess [6] of the Drupal Security Team * Adam G-H [7] * Drew Webber [8] of the Drupal Security Team

Coordinated By:  * xjm [9] of the Drupal Security Team * Drew Webber [10] of the Drupal Security Team

[1] https://www.drupal.org/project/entity_embed [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/sa-core-2021-006 [4] https://www.drupal.org/project/entity_embed/releases/8.x-1.2 [5] https://www.drupal.org/user/518662 [6] https://www.drupal.org/user/65776 [7] https://www.drupal.org/user/205645 [8] https://www.drupal.org/user/255969 [9] https://www.drupal.org/u/xjm [10] https://www.drupal.org/u/mcdruid