Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.Project:
Date:
2024-December-11
Vulnerability:
Cross site scripting
Affected versions:
>=1.0.0 <2.0.2
CVE IDs:
CVE-2024-13308
Description:
This module provides a block that renders a link providing the functionality of a browser's back button.
The module does not sufficiently escape text entered by an administrator, resulting in a cross scripting vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer blocks".
Solution:
Install the latest version:
- If you use the Browser Back Button module for Drupal 9.x/10.x, upgrade to Browser Back Button 2.0.2
Reported By:
Fixed By:
Coordinated By:
- Ivo Van Geertruyen of the Drupal Security Team
