[Security-news] Doubleclick for Publishers (DFP) - Moderately critical - Cross site scripting - SA-CONTRIB-2022-035

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2022-035

Project: Doubleclick for Publishers (DFP) [1]
Date: 2022-May-04
Security risk: *Moderately critical* 13∕25
AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2]
Vulnerability: Cross site scripting

Description: 
Doubleclick for Publishers (DFP) module enables a site to place ads from
Doubleclick For Publishers.

The module doesn't sanitize user input in certain cases, which leads to
Cross-Site-Scripting (XSS) vulnerabilities. An attacker that can create or
edit certain entities may be able to exploit a Cross-Site-Scripting (XSS)
vulnerability to target visitors of the site, including site admins with
privileged access.

This vulnerability is mitigated by the fact that an attacker must have a role
with the permission "administer DFP".

Solution: 
Install the latest version:

   * If you use the Doubleclick for Publishers module for Drupal 9.x, upgrade
     to DFP 8.x-1.2 [3]

Note that the Drupal 7 version of this module is unaffected.

Reported By: 
   * John Herreño [4]

Fixed By: 
   * John Herreño [5]
   * Marcelo Vani [6]

Coordinated By: 
   * Lee Rowlands [7] of the Drupal Security Team
   * Greg Knaddison [8] of the Drupal Security Team
   * Damien McKenna [9] of the Drupal Security Team


[1] https://www.drupal.org/project/dfp
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/dfp/releases/8.x-1.2
[4] https://www.drupal.org/user/350711
[5] https://www.drupal.org/user/350711
[6] https://www.drupal.org/user/854220
[7] https://www.drupal.org/user/395439
[8] https://www.drupal.org/user/36762
[9] https://www.drupal.org/user/108450