The 2026 Drupal Business Survey is open. Your response will help shape the future of the Drupal business ecosystem.Project:
Project machine name:
opigno_learning_pathDate:
2021-June-23
Vulnerability:
UI redressing (clickjacking)
Affected versions:
<1.11.0
Description:
This project is related to Opigno LMS distribution. It implements the learning path, that combines together in a very flexible way the differents steps of a training in Opigno LMS.
The module does not set X-Frame-Options and blocks ability of other modules (e.g Security Kit) to add them, leaving it vulnerable to Clickjacking.
Solution:
Install the latest version:
- If you use the Opigno learning path module for Drupal 8.x, upgrade to a version greater than 8.x-1.10 Opigno learning path 8.x-1.11 or later
The issue was fixed in public but needed a security advisory. Users of the module are encouraged to upgrade to at least 8.x-1.11 or a later version to gain protection against this weakness.
Reported By:
Fixed By:
Coordinated By:
- Greg Knaddison of the Drupal Security Team
- Damien McKenna of the Drupal Security Team
