Civictheme Design System
Monthly
Cross-site scripting in Drupal CivicTheme Design System before 1.12.0 allows unauthenticated remote attackers to execute script in a victim's browser when the victim interacts with attacker-controlled content, as reflected by CVSS PR:N/UI:R. The flaw is rated CVSS 3.1 6.1 with scope change and low confidentiality/integrity impact, and it does not enable silent server-side compromise. No public exploit was identified at time of analysis, and EPSS is low at 0.20% (9th percentile); a vendor patch is available.
Unauthenticated, network-reachable attackers can read access-restricted content on Drupal sites running the CivicTheme Design System contributed module at versions from 0.0.0 up to but not including 1.12.0, because the module's authorization logic is incorrect (CWE-863), permitting forceful browsing directly to resources that should be protected. With CVSS 3.1 scored 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), no authentication, user interaction, or non-default configuration is indicated as required, and the impact is confined to confidentiality - unauthorized disclosure of restricted resources rather than modification or denial of service. Exposure is limited to sites that have installed CivicTheme and rely on it to gate access to content; no public exploit code or confirmed active exploitation was identified at time of analysis.
Cross-site scripting in Drupal CivicTheme Design System before 1.12.0 allows unauthenticated remote attackers to execute script in a victim's browser when the victim interacts with attacker-controlled content, as reflected by CVSS PR:N/UI:R. The flaw is rated CVSS 3.1 6.1 with scope change and low confidentiality/integrity impact, and it does not enable silent server-side compromise. No public exploit was identified at time of analysis, and EPSS is low at 0.20% (9th percentile); a vendor patch is available.
Unauthenticated, network-reachable attackers can read access-restricted content on Drupal sites running the CivicTheme Design System contributed module at versions from 0.0.0 up to but not including 1.12.0, because the module's authorization logic is incorrect (CWE-863), permitting forceful browsing directly to resources that should be protected. With CVSS 3.1 scored 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), no authentication, user interaction, or non-default configuration is indicated as required, and the impact is confined to confidentiality - unauthorized disclosure of restricted resources rather than modification or denial of service. Exposure is limited to sites that have installed CivicTheme and rely on it to gate access to content; no public exploit code or confirmed active exploitation was identified at time of analysis.