DRUPAL-CONTRIB-2023-016
The Iubenda Integration module provides a custom block to provide a link to the Iubenda privacy policy. On this block, a custom prefix and suffix text can be entered.
The module does not sufficiently filter the block text fields on output, resulting in a Cross-Site Scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with permission to use the layout builder on content, edit the layout, or with the "Administer blocks" permission.
What each source reports
OSV No score
The Iubenda Integration module provides a custom block to provide a link to the Iubenda privacy policy. On this block, a custom prefix and suffix text can be entered.
The module does not sufficiently filter the block text fields on output, resulting in a Cross-Site Scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with permission to use the layout builder on content, edit the layout, or with the "Administer blocks" permission.
- Record
DRUPAL-CONTRIB-2023-016- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/iubenda_integrationPackagist:https://packages.drupal.org/8 |
before 4.0.1 | 4.0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
DRUPAL-CONTRIB-2023-016 is a vulnerability with no CVSS score yet in drupal/iubenda_integration, published May 31, 2023. No source lists public exploit code. Fixed in drupal/iubenda_integration 4.0.1.