View online: https://www.drupal.org/sa-contrib-2022-049 Project: Context [1] Version: 7.x-3.107.x-3.97.x-3.87.x-3.77.x-3.67.x-3.57.x-3.47.x-3.37.x-3.27.x-3.17.x-3.07.x-3.0-rc17.x-3.0-beta77.x-3.0-beta67.x-3.0-beta57.x-3.0-beta47.x-3.0-beta37.x-3.0-beta27.x-3.0-beta17.x-3.0-alpha37.x-3.0-alpha27.x-3.0-alpha1 Date: 2022-July-27 Security risk: *Moderately critical* 12∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Scripting Description:  This module enables you to conditionally display blocks in particular theme regions. The module doesn't sufficiently sanitize the title of a block as displayed in the admin UI when a site administrator edits a context block reaction. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer blocks". Solution:  Install the latest version: * If you use the Context module for Drupal 7.x, upgrade to Context 7.x-3.11. [3] Reported By:  * Harold Aling [4] Fixed By:  * Harold Aling [5] * Bostjan Kovac [6] * Nedjo Rogers [7] Coordinated By:  * Damien McKenna [8] of the Drupal Security Team * Greg Knaddison [9] of the Drupal Security Team * Michael Hess [10] of the Drupal Security Team [1] https://www.drupal.org/project/context [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/context/releases/7.x-3.11 [4] https://www.drupal.org/user/168440 [5] https://www.drupal.org/user/168440 [6] https://www.drupal.org/user/1773456 [7] https://www.drupal.org/user/4481 [8] https://www.drupal.org/user/108450 [9] https://www.drupal.org/user/36762 [10] https://www.drupal.org/user/102818