Project
Responsive Favicons
Date
Severity
Moderately Critical
Risk Score
13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability
Cross-site scripting
Affected versions
<7.x-1.4

Description

The Responsive Favicons module adds the favicons generated by realfavicongenerator.net to your Drupal site.

The module does not filter administrator-entered text, leading to a persistent Cross-site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer responsive favicons".

Solution

Install the latest version, then confirm the permissions associated with the module are assigned to appropriate roles.

If you use the Responsive Favicons module for Drupal 7, upgrade to Responsive Favicons 7.x-1.4:

Reported by

Fixed by

Coordinated by