CVSS2
Attack Vector
NETWORK
Attack Complexity
HIGH
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:H/Au:N/C:N/I:P/A:N
EPSS
Percentile
99.7%
The Password Policy module allows enforcing restrictions on user passwords by defining password policies.
The module doesn’t sufficiently sanitize usernames in some administration pages, thereby exposing a Cross Site Scripting vulnerability.
This vulnerability is mitigated by the fact that only sites with a policy that uses the username constraint are affected. Also, only sites importing users from an external source (like distributed authentication) may allow non-standard usernames that might contain malicious characters, as Drupal core has validation when creating users via the user interface.
Drupal core is not affected. If you do not use the contributed Password policy module, there is nothing you need to do.
Install the latest version:
Also see the Password policy project page.
twitter.com/drupalsecurity
www.drupal.org/contact
www.drupal.org/project/password_policy
www.drupal.org/security-team
www.drupal.org/security-team/risk-levels
www.drupal.org/security/secure-configuration
www.drupal.org/user/2301194
www.drupal.org/user/aohrveptv
www.drupal.org/user/aohrvetpv
www.drupal.org/writing-secure-code