Date:
Thursday, Feb 29th, 2024
Advisory ID:
BACKDROP-SA-CONTRIB-2024-002
Security risk:
Moderately Critical
Vulnerability:
Cross Site Scripting
Versions affected:
- Coffee module versions prior to 1.x-2.2.2
Description:
The Coffee module helps you to navigate through the Backdrop admin menus faster with a shortcut popup.
The module doesn't sufficiently escape menu names when displaying them in the popup, thereby exposing a XSS vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer menus and menu links".
Solution:
Upgrade your site to use the 1.x-2.2.2 version of the Coffee module.
Reported By:
Fixed By:
- Michael Mol
- Oliver Köhler
- Klaus Purer of the D7 Security Group
- Jen Lampton of the Backdrop CMS Security Team
Coordinated By:
- Laryn Kragt Bakker
- Herb van Dool
- Jen Lampton of the Backdrop CMS Security Team