Description
The Popup module provides a filter and insert form that let editors embed configurable popup elements such as blocks, views, menus, and nodes into content.
The Popup Filter submodule doesn't sanitize the values it writes into HTML option elements in its admin AJAX callbacks, concatenating the block information string and the view display title from configuration directly into markup that is returned as a text/html response and then inserted into the page with JavaScript, so a payload stored by a user with the administer blocks or administer views permission executes in the browser of the administrator using the popup insert form.
This vulnerability is mitigated by the fact that planting the payload requires the administer blocks or administer views permission and viewing it requires the administer popup elements permission, so exploitation depends on administrative access on both sides.
Solution
Install the latest version.
If you use the Popup module for Drupal 7, upgrade to Popup 7.x-1.5:
Reported by
Fixed by
- Tag1 D7ES
Coordinated by
- Tag1 D7ES