[IT-SecNots] [Security-news] AdobeAnalytics - Moderately critical - Cross-site scripting - SA-CONTRIB-2026-311

[security-news AT drupal.org]

View online: https://www.drupal.org/sa-contrib-2026-311

Project: AdobeAnalytics [1]
Project machine name: adobe_analytics
Date: 2026-November-04
Security risk: *Moderately critical* 13 ∕ 25
AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2]
Vulnerability: Cross-site scripting

Affected versions: <1.1.0
CVE IDs: CVE-2026-122083
Description: 
This module integrates the Site Catalyst or AdobeAnalytics software into a
Drupal site.

The module does not sufficiently provide access controls for advanced
functionality, which exposes a cross-site scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have
permission to add or edit content that is configured to use the module's
functionality.

Solution: 
Install the latest version:

 * Upgrade to adobe_analytics 8.x-1.1 [3].

Reported By: 
 * Francisco Javier Rodriguez (nodles) [4]

Fixed By: 
 * Zeeshaan khann (zeeshan_khan) [5]
 * Joseph Olstad (joseph.olstad) [6]

Coordinated By: 
 * Swan Kalata (akalata) [7] of the Drupal Security Team
 * Juraj Nemec (poker10) [8] of the Drupal Security Team
 * Jess  (xjm) [9] of the Drupal Security Team

------------------------------------------------------------------------------
Contribution record [10]

[1] https://www.drupal.org/project/adobe_analytics
[2] https://www.drupal.org/drupal-security-team/security-risk-levels-defined
[3] https://www.drupal.org/project/adobe_analytics/releases/8.x-1.1
[4] https://www.drupal.org/u/nodles
[5] https://www.drupal.org/u/zeeshan_khan
[6] https://www.drupal.org/u/josepholstad
[7] https://www.drupal.org/u/akalata
[8] https://www.drupal.org/u/poker10
[9] https://www.drupal.org/u/xjm
[10]  
https://new.drupal.org/contribution-record?source_link=https%3A//www.drupal.org/node/3634930

_______________________________________________
Security-news mailing list -- security-news AT drupal.org
To unsubscribe send an email to security-news-leave AT drupal.org
Unsubscribe at