DRUPAL-CONTRIB-2022-046
The Lottiefiles Field module enables you to integrate the lottiefiles features into your page.
The module does not sufficiently filter user-provided text on output, resulting in a Cross-Site Scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create or edit content that has lottiefiles fields.
What each source reports
OSV No score
The Lottiefiles Field module enables you to integrate the lottiefiles features into your page.
The module does not sufficiently filter user-provided text on output, resulting in a Cross-Site Scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create or edit content that has lottiefiles fields.
- Record
DRUPAL-CONTRIB-2022-046- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/lottiefiles_fieldPackagist:https://packages.drupal.org/8 |
before 1.0.3 | 1.0.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
DRUPAL-CONTRIB-2022-046 is a vulnerability with no CVSS score yet in drupal/lottiefiles_field, published June 29, 2022. No source lists public exploit code. Fixed in drupal/lottiefiles_field 1.0.3.