The Drupal core Navigation module’s tooltip script inserted the data-drupal-tooltip and data-drupal-tooltip-class attribute values into the page as HTML. A user who can edit menu link titles (administer menu) or enter HTML with these data attributes can run JavaScript in the browser of every administrator who opens the navigation sidebar.
This vulnerability affects the following application versions:
- Drupal 10.3.0
- Drupal 10.3.1
- Drupal 10.3.2
- Drupal 10.3.3
- Drupal 10.3.4
- Drupal 10.3.5
- Drupal 10.3.6
- Drupal 10.3.7
- Drupal 10.3.8
- Drupal 10.3.9
- Drupal 10.3.10
- Drupal 10.3.11
- Drupal 10.3.12
- Drupal 10.3.13
- Drupal 10.3.14
- Drupal 10.4.0
- Drupal 10.4.1
- Drupal 10.4.2
- Drupal 10.4.3
- Drupal 10.4.4
- Drupal 10.4.5
- Drupal 10.4.6
- Drupal 10.4.7
- Drupal 10.4.8
- Drupal 10.4.9
- Drupal 10.4.10
- Drupal 10.5.0
- Drupal 10.5.1
- Drupal 10.5.2
- Drupal 10.5.3
- Drupal 10.5.4
- Drupal 10.5.5
- Drupal 10.5.6
- Drupal 10.5.7
- Drupal 10.5.8
- Drupal 10.5.9
- Drupal 10.5.10
- Drupal 10.5.11
- Drupal 10.5.12
- Drupal 10.6.0
- Drupal 10.6.1
- Drupal 10.6.2
- Drupal 10.6.3
- Drupal 10.6.4
- Drupal 10.6.5
- Drupal 10.6.6
- Drupal 10.6.7
- Drupal 10.6.8
- Drupal 10.6.9
- Drupal 10.6.10
- Drupal 10.6.11
- Drupal 10.6.12
- Drupal 10.6.13
- Drupal 10.6.14
- Drupal 10.6.15
- Drupal 10.6.16
- Drupal 10.6.17
- Drupal 10.6.18
- Drupal 11.0.0
- Drupal 11.0.1
- Drupal 11.0.2
- Drupal 11.0.3
- Drupal 11.0.4
- Drupal 11.0.5
- Drupal 11.0.6
- Drupal 11.0.7
- Drupal 11.0.8
- Drupal 11.0.9
- Drupal 11.0.10
- Drupal 11.0.11
- Drupal 11.0.12
- Drupal 11.0.13
- Drupal 11.1.0
- Drupal 11.1.1
- Drupal 11.1.2
- Drupal 11.1.3
- Drupal 11.1.4
- Drupal 11.1.5
- Drupal 11.1.6
- Drupal 11.1.7
- Drupal 11.1.8
- Drupal 11.1.9
- Drupal 11.1.10
- Drupal 11.2.0
- Drupal 11.2.1
- Drupal 11.2.2
- Drupal 11.2.3
- Drupal 11.2.4
- Drupal 11.2.5
- Drupal 11.2.6
- Drupal 11.2.7
- Drupal 11.2.8
- Drupal 11.2.9
- Drupal 11.2.10
- Drupal 11.2.11
- Drupal 11.2.12
- Drupal 11.2.13
- Drupal 11.2.14
- Drupal 11.3.0
- Drupal 11.3.1
- Drupal 11.3.2
- Drupal 11.3.3
- Drupal 11.3.4
- Drupal 11.3.5
- Drupal 11.3.6
- Drupal 11.3.7
- Drupal 11.3.8
- Drupal 11.3.9
- Drupal 11.3.10
- Drupal 11.3.11
- Drupal 11.3.12
- Drupal 11.3.13
- Drupal 11.3.14
- Drupal 11.3.15
- Drupal 11.3.16
- Drupal 11.3.17
- Drupal 11.3.18
- Drupal 11.4.0
- Drupal 11.4.1
- Drupal 11.4.2
- Drupal 11.4.3
- Drupal 11.4.4
- Drupal 11.4.5
- Drupal 11.4.6
- Drupal 11.4.7
- Drupal 11.4.8
- Drupal 11.4.9