CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS
Percentile
57.2%
This project allows you to create various types of tournaments (as nodes) and associated teams, tournaments, and matches.
There are several cases in the project where an account username, node title, and team entity title are not correctly filtered before being displayed to a user.
It is possible to create nodes or entities containing XSS or usernames could be imported with XSS in the strings or created via an add-on module like LDAP or similar.
This vulnerability is mitigated by the fact that an attacker must have a role with the permissions “Create new teams” or “Tournament: Create new content” or “Match: Create new content” or the ability to create users with an XSS payload in the usernames (Drupal core’s input validation prevents XSS payloads in usernames).
Drupal core is not affected. If you do not use the contributed Tournament module,
there is nothing you need to do.
Install the latest version:
Also see the Tournament project page.