View online: https://www.drupal.org/sa-contrib-2023-006
Project: Better Social Sharing Buttons [1] Date: 2023-March-01 Security risk: *Less critical* 8∕25 AC:Basic/A:User/CI:None/II:None/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting
Description: This module enables you to add social sharing buttons to a site.
The module doesn't sufficiently sanitize the weight and ratio values entered in the module or block configuration.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer blocks".
Solution: Install the latest version:
* If you use the Better Social Sharing Buttons module for Drupal 9 or 10, upgrade to Better Social Sharing Buttons 4.0.3 [3]
Reported By: * cydave [4]
Fixed By: * cydave [5] * Shelane French [6]
Coordinated By: * Damien McKenna [7] of the Drupal Security Team
[1] https://www.drupal.org/project/better_social_sharing_buttons [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/better_social_sharing_buttons/releases/4.0.3 [4] https://www.drupal.org/user/3751740 [5] https://www.drupal.org/user/3751740 [6] https://www.drupal.org/user/2674989 [7] https://www.drupal.org/user/108450