[Security-news] Lottiefiles Field - Moderately critical - Cross Site Scripting - SA-CONTRIB-2022-046

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2022-046

Project: Lottiefiles Field [1]
Date: 2022-June-29
Security risk: *Moderately critical* 14∕25
AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2]
Vulnerability: Cross Site Scripting

Description: 
The Lottiefiles Field module enables you to integrate the lottiefiles
features into your page.

The module does not sufficiently filter user-provided text on output,
resulting in a Cross-Site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role
with the permission to create or edit content that has lottiefiles fields.

Solution: 
Install the latest version:

   * If you use the lottifiles_field module for Drupal 8.x or 9.x, upgrade to
     Lottiefiles Field 1.0.3 [3].

Reported By: 
   * Conrad Lara [4]

Fixed By: 
   * Hari Venu [5]
   * Conrad Lara [6]

Coordinated By: 
   * Greg Knaddison [7] of the Drupal Security Team


[1] https://www.drupal.org/project/lottiefiles_field
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/lottiefiles_field/releases/1.0.3
[4] https://www.drupal.org/user/1790054
[5] https://www.drupal.org/user/3386122
[6] https://www.drupal.org/user/1790054
[7] https://www.drupal.org/user/36762