Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2022-001

Read Time:1 Minute, 21 Second

Project:

Drupal core

Date:

2022-January-19

Security risk:

Moderately critical 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:Default

Vulnerability:

Cross Site Scripting

Description:

jQuery UI is a third-party library used by Drupal. This library was previously thought to be end-of-life.

Late in 2021, jQuery UI announced that they would be continuing development, and released a jQuery UI 1.13.0 version. As part of this 1.13.0 update, they disclosed the following security issue that may affect Drupal 9 and 7:

CVE-2021-41184: XSS in the `of` option of the `.position()` util

It is possible that this vulnerability is exploitable with some Drupal modules. As a precaution, this Drupal security release applies the fix for the above cross-site description issue, without making any of the other changes to the jQuery version that is included in Drupal.

This advisory is not covered by Drupal Steward.

Solution:

Install the latest version:

If you are using Drupal 9.3, update to Drupal 9.3.3.
If you are using Drupal 9.2, update to Drupal 9.2.11.
If you are using Drupal 7, update to Drupal 7.86.

All versions of Drupal 8 and 9 prior to 9.2.x are end-of-life and do not receive security coverage. Note that Drupal 8 has reached its end of life.

Reported By:

Lauri Eskola

Fixed By:

Lauri Eskola
Chris of the Drupal Security Team
Drew Webber of the Drupal Security Team
Alex Bronstein of the Drupal Security Team
Ben Mullins
xjm of the Drupal Security Team
Théodore Biadala

Smashing Security podcast #411: The fall of Troy, and whisky barrel scammers

Stripe API Skimming Campaign Unveils New Techniques for Theft

Royal Mail Investigates Data Breach Affecting Supplier

Gray Bots Surge as Generative AI Scraper Activity Increases

Bybit Heist Fuels Record Crypto-Theft Surge, Says CertiK

Rational Astrologies and Security

North Korea’s Fake IT Worker Scheme Sets Sights on Europe

Steam Surges to Top of Most Spoofed Brands List in Q1

ICO Apologizes After Data Protection Response Snafu

Drupal core – Moderately critical – Cross Site Scripting – SA-CORE-2022-001

cri-o1.31-1.31.7-1.fc43

zabbix-7.2.5-1.fc42

zabbix7.0-7.0.11-1.el8

zabbix7.0-7.0.11-1.el9

zabbix6.0-6.0.39-1.el8

zabbix-7.0.11-1.fc41