Jimmy Henderickx

A missing authorization issue exists in Drupal Facets, potentially allowing forceful browsing. The issue relates to insufficient access controls.

The issue is related to improper neutralization of input during web page generation, which allows Cross-Site Scripting (XSS). This can be exploited by a remote attacker to hijack a user's session. The problem is associated with the two-factor authentication module and incorrect session management.

The issue allows remote attackers to obtain sensitive username information. This is possible by leveraging a configuration that permits using an email address to login and a module that permits logging in.