Frequently Asked Questions - Moderately critical - Cross Site Scripting - SA-CONTRIB-2021-012

Project: Frequently Asked QuestionsDate: 2021-June-02Security risk: Moderately critical 11∕25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site ScriptingDescription: The Frequently Asked Questions (faq) module allows users, with appropriate permissions, to create question and answer pairs which they want displayed on the 'faq' page. The 'faq' page is automatically generated from the FAQ nodes configured. Basic Views layouts are also provided and can be customised via the Views UI (rather than via the module settings page).
The module doesn't sufficiently sanitize editor input leading to a Cross Site Scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with the "create faq content" permission.Solution: Install the latest version:

Reported By: 

Fixed By: 

Coordinated By: 

Path to article