| Package | Affected versions | Patched versions |
|---|---|---|
| drupal/orejime | < 2.0.16 | 2.0.16 |
| orejime | < 2.0.16 | 2.0.16 |
The IframeConsent element writes HTML attributes without escaping their value.
This module has a XSS vulnerability. If an attacker is able to write an <iframe-consent> tag, they may be able to insert arbitrary JavaScript.
This vulnerability is mitigated by the fact that a text format that allows iframe-consent HTML tags with alt attributes in the necessary option (Enable JS Iframe consent) must be enabled, and an attacker must have a role allowing the creation or modification of content in a field with text the format.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free