[Security-news] Link - Moderately critical - Cross site scripting - SA-CONTRIB-2022-034

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2022-034

Project: Link [1]
Date: 2022-May-04
Security risk: *Moderately critical* 13∕25
AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2]
Vulnerability: Cross site scripting

Description: 
This module enables you to add URL fields to entity types with a variety of
options.

The module doesn't sufficiently filter output when token processing is
disabled on an individual field.

This vulnerability is mitigated by the fact that an attacker must have a role
with the permission to create content and the token processing option must be
disabled.

Solution: 
Install the latest version:

   * If you use the Link module for Drupal 7.x, upgrade to Link 7.x-1.11 [3]

Reported By: 
   * Brad Bulger [4]

Fixed By: 
   * Damien McKenna [5] of the Drupal Security Team
   * Brad Bulger [6]
   * Greg Knaddison [7] of the Drupal Security Team

Coordinated By: 
   * Greg Knaddison [8] of the Drupal Security Team
   * Damien McKenna [9] of the Drupal Security Team


[1] https://www.drupal.org/project/link
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/link/releases/7.x-1.11
[4] https://www.drupal.org/user/64630
[5] https://www.drupal.org/user/108450
[6] https://www.drupal.org/user/64630
[7] https://www.drupal.org/user/36762
[8] https://www.drupal.org/user/36762
[9] https://www.drupal.org/user/108450