[Security-news] Better Social Sharing Buttons - Less critical - Cross Site Scripting - SA-CONTRIB-2023-006

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2023-006

Project: Better Social Sharing Buttons [1]
Date: 2023-March-01
Security risk: *Less critical* 8∕25
AC:Basic/A:User/CI:None/II:None/E:Theoretical/TD:All [2]
Vulnerability: Cross Site Scripting

Description: 
This module enables you to add social sharing buttons to a site.

The module doesn't sufficiently sanitize the weight and ratio values entered
in the module or block configuration.

This vulnerability is mitigated by the fact that an attacker must have a role
with the permission "administer blocks".

Solution: 
Install the latest version:

   * If you use the Better Social Sharing Buttons module for Drupal 9 or 10,
     upgrade to Better Social Sharing Buttons 4.0.3 [3]

Reported By: 
   * cydave [4]

Fixed By: 
   * cydave [5]
   * Shelane French [6]

Coordinated By: 
   * Damien McKenna [7] of the Drupal Security Team


[1] https://www.drupal.org/project/better_social_sharing_buttons
[2] https://www.drupal.org/security-team/risk-levels
[3]
https://www.drupal.org/project/better_social_sharing_buttons/releases/4.0.3
[4] https://www.drupal.org/user/3751740
[5] https://www.drupal.org/user/3751740
[6] https://www.drupal.org/user/2674989
[7] https://www.drupal.org/user/108450