DRUPAL-CONTRIB-2018-059

See a problem?
Import Source
https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/fraction/DRUPAL-CONTRIB-2018-059.json
JSON Data
https://api.osv.dev/v1/vulns/DRUPAL-CONTRIB-2018-059
Published
2018-09-05T17:22:50Z
Modified
2025-12-10T23:33:27.679892Z
Summary
[none]
Details

This module enables you to create fields for storing decimal values as two integers (numerator and denominator) for maximum precision.

The module doesn't sufficiently filter XSS strings out of field labels.

This vulnerability is mitigated by the fact that an attacker must have a role with the ability to manage field configuration.

References
Credits

Affected packages

Packagist:https://packages.drupal.org/8 / drupal/fraction

Package

Name
drupal/fraction
Purl
pkg:composer/drupal/fraction

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.2.0
Database specific 
{
    "constraint": "<1.2.0"
}

Database specific

affected_versions 
"<1.2.0"
source 
"https://github.com/DrupalSecurityTeam/drupal-advisory-database/blob/main/advisories/fraction/DRUPAL-CONTRIB-2018-059.json"