Umami Analytics
Monthly
Cross-site scripting in the Drupal Umami Analytics contributed module (versions 0.0.0 up to but not including 1.0.1) allows a user who already holds a high-privileged Drupal account with permission to configure the module to inject markup that is later rendered without output neutralization for other users viewing the affected page. The high-privilege prerequisite (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N, score 3.8) sharply narrows the attacker population to trusted/administrative users, there is no availability impact, and EPSS places exploitation likelihood at about 0.2% (9th percentile). There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but a vendor patch is available.
Cross-site scripting in the Drupal Umami Analytics contributed module (versions 0.0.0 up to but not including 1.0.1) allows a user who already holds a high-privileged Drupal account with permission to configure the module to inject markup that is later rendered without output neutralization for other users viewing the affected page. The high-privilege prerequisite (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N, score 3.8) sharply narrows the attacker population to trusted/administrative users, there is no availability impact, and EPSS places exploitation likelihood at about 0.2% (9th percentile). There is no public exploit identified at time of analysis and the issue is not in CISA KEV, but a vendor patch is available.