[Security-news] Entity Embed - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2021-028

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2021-028

Project: Entity Embed [1]
Date: 2021-September-15
Security risk: *Moderately critical* 11∕25
AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:All [2]
Vulnerability: Cross Site Request Forgery

CVE IDs: CVE-2020-13673
Description: 
This advisory addresses a similar issue to Drupal core - Moderately critical
- Cross Site Request Forgery - SA-CORE-2021-006 [3].

The Entity Embed module provides a filter to allow embedding entities in
content fields. In certain circumstances, the filter could allow an
unprivileged user to inject HTML into a page when it is accessed by a trusted
user with permission to embed entities. In some cases, this could lead to
cross-site scripting.

Solution: 
Install the latest version:

   * If you use the Entity Embed module for Drupal 8 or 9, upgrade to Entity
     Embed 8.x-1.2 [4].

Drupal 7 versions of Entity Embed do not have a stable release and therefore
do not receive security coverage.

Reported By: 
   * Aaron Zinck [5]

Fixed By: 
   * Jess  [6] of the Drupal Security Team
   * Adam G-H [7]
   * Drew Webber [8] of the Drupal Security Team

Coordinated By: 
   * xjm [9] of the Drupal Security Team
   * Drew Webber [10] of the Drupal Security Team


[1] https://www.drupal.org/project/entity_embed
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/sa-core-2021-006
[4] https://www.drupal.org/project/entity_embed/releases/8.x-1.2
[5] https://www.drupal.org/user/518662
[6] https://www.drupal.org/user/65776
[7] https://www.drupal.org/user/205645
[8] https://www.drupal.org/user/255969
[9] https://www.drupal.org/u/xjm
[10] https://www.drupal.org/u/mcdruid