CVSS base score
What the vulnerability does
Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO - Service Provider allows Cross-Site Scripting (XSS).This issue affects SAML SSO - Service Provider: from 0.0.0 before 3.1.3.
Explanation of Vulnerability in Simple Terms
The SAML SSO - Service Provider module for Drupal contains a cross-site scripting (XSS) vulnerability in versions before 3.1.3. An attacker can inject malicious scripts that execute in users' browsers when they interact with SAML authentication flows. The vulnerability stems from insufficient input sanitization in SAML response handling. Update to version 3.1.3 or later to remediate.
What an attacker can do
Inject malicious JavaScript that runs in users' browsers during SAML authentication.
Potential impact on your site
Attackers can steal session cookies, redirect users, or deface content seen during SAML login flows.
Conditions required to exploit
User interaction required; victim must visit a page or click a link containing the malicious payload.
Key dates
External resources
Related vulnerabilities
