Jã¼Rgen Haas

An issue exists where the Navigation module does not sufficiently sanitize certain attributes, leading to Cross-Site Scripting (XSS), a condition where malicious scripts are injected into trusted websites. Exploitation requires the attacker to possess a role with permission to enter HTML tags containing specific data attributes or the `administer menu` permission.

An issue exists where the module does not sufficiently sanitize certain attributes, leading to cross-site scripting (XSS), a flaw that allows attackers to inject malicious scripts into web pages. Approximately 15,300 instances have been identified globally. Exploitation requires the attacker to possess a role with permission to enter HTML tags containing specific data attributes or the `administer menu` permission.

A missing authorization issue allows forceful browsing. The module provides a route for signage devices to refresh dynamic blocks on a display, but it fails to verify if the requester is an authorized signage device or if the requested block is intended for display. Consequently, an anonymous visitor can read the rendered content of blocks they are not authorized to see. This is partially mitigated if block plugins perform their own access checks on the content.

Improperly controlled modification of dynamically-determined object attributes allows Object Injection. Additionally, the Render submodule fails to sufficiently sanitize template code when rendering inline Twig templates as part of no-code models, which can lead to information disclosure. This issue is mitigated if the site is not running an ECA model that utilizes the "Render: Twig" action on a data flow.

An authorization issue exists in Drupal Entity Share that permits forceful browsing. This flaw potentially allows unauthorized access to resources.