DRUPAL-CONTRIB-2023-023
This module enables you to define configurable GDPR alert messages.
The module doesn't sufficiently filter user-supplied text leading to a Cross Site Scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker needs additional permissions. The vulnerability can be exploited by an attacker with a role with the permission "administer gdpr alert" regardless of other configurations.
What each source reports
OSV No score
This module enables you to define configurable GDPR alert messages.
The module doesn't sufficiently filter user-supplied text leading to a Cross Site Scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker needs additional permissions. The vulnerability can be exploited by an attacker with a role with the permission "administer gdpr alert" regardless of other configurations.
- Record
DRUPAL-CONTRIB-2023-023- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
drupal/gdpr_alertPackagist:https://packages.drupal.org/8 |
1.0.0 up to 1.0.1 | 1.0.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
DRUPAL-CONTRIB-2023-023 is a vulnerability with no CVSS score yet in drupal/gdpr_alert, published June 28, 2023. No source lists public exploit code. Fixed in drupal/gdpr_alert 1.0.1.