[Security-news] Expandable Formatter - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-028

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2023-028

Project: Expandable Formatter [1]
Version: 8.x-1.38.x-1.28.x-1.18.x-1.0
Date: 2023-June-28
Security risk: *Moderately critical* 14∕25
AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2]
Vulnerability: Cross Site Scripting

Description: 
This module enables you to render a field in an expandable/collapsible
region.

The module doesn't sufficiently sanitize the field content when displaying it
to an end user.

This vulnerability is mitigated by the fact that an attacker must have a role
capable of creating content that uses the field formatter.

Solution: 
Install the latest version:

   * If you use the Expandable Formatter module for Drupal 8.x, upgrade to
     Expandable Formatter 8.x-1.4 [3]

Reported By: 
   * Mariusz Andrzejewski [4]
   * Mitch Portier [5]

Fixed By: 
   * cilefen  [6] of the Drupal Security Team
   * Kevin Dutra [7]
   * Mariusz Andrzejewski [8]
   * Mitch Portier [9]

Coordinated By: 
   * Damien McKenna [10] of the Drupal Security Team
   * Greg Knaddison [11] of the Drupal Security Team
   * cilefen [12] of the Drupal Security Team


[1] https://www.drupal.org/project/expandable_formatter
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/expandable_formatter/releases/8.x-1.4
[4] https://www.drupal.org/user/3517832
[5] https://www.drupal.org/user/2284182
[6] https://www.drupal.org/user/1850070
[7] https://www.drupal.org/user/1312744
[8] https://www.drupal.org/user/3517832
[9] https://www.drupal.org/user/2284182
[10] https://www.drupal.org/user/108450
[11] https://www.drupal.org/user/36762
[12] https://www.drupal.org/user/1850070