DRUPAL-CONTRIB-2022-035
Doubleclick for Publishers (DFP) module enables a site to place ads from Doubleclick For Publishers.
The module doesn't sanitize user input in certain cases, which leads to Cross-Site-Scripting (XSS) vulnerabilities. An attacker that can create or edit certain entities may be able to exploit a Cross-Site-Scripting (XSS) vulnerability to target visitors of the site, including site admins with privileged access.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer DFP".
What each source reports
OSV No score
Doubleclick for Publishers (DFP) module enables a site to place ads from Doubleclick For Publishers.
The module doesn't sanitize user input in certain cases, which leads to Cross-Site-Scripting (XSS) vulnerabilities. An attacker that can create or edit certain entities may be able to exploit a Cross-Site-Scripting (XSS) vulnerability to target visitors of the site, including site admins with privileged access.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer DFP".
- Record
DRUPAL-CONTRIB-2022-035- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/dfpPackagist:https://packages.drupal.org/8 |
before 1.2.0 | 1.2.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
DRUPAL-CONTRIB-2022-035 is a vulnerability with no CVSS score yet in drupal/dfp, published May 4, 2022. No source lists public exploit code. Fixed in drupal/dfp 1.2.0.