XSS vulnerability when rendering filename in Webform Multiform
Summary
XSS vulnerability when rendering filename in Webform Multiform
Original description
The description as published by the source.
Webform Multiple File Upload module for Drupal 7.x contains a cross-site scripting (XSS) vulnerability in the file name renderer. An unauthenticated attacker can exploit this vulnerability by uploading a file with a malicious
filename containing JavaScript code (e.g., "") to a Webform node with a Multifile field where file type validation is disabled. This allows the execution of arbitrary scripts
in the context of the victim's browser.
The issue is present in a third-party library and has been addressed in a patch available at https://github.com/fyneworks/multifile/pull/44 . Users are advised to apply the provided patch or update to a fixed version of the module.
References
- advisory d7es.tag1.com
- advisory github.com
- advisory nvd.nist.gov
- advisory d7security.org
- advisory herodevs.com
- report drupal.org
- web git.drupalcode.org
- web drupal.org