[Security-news] AddToAny Share Buttons - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-019

[security-news at drupal.org]

View online: https://www.drupal.org/sa-contrib-2023-019

Project: AddToAny Share Buttons [1]
Date: 2023-May-31
Security risk: *Moderately critical* 13∕25
AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2]
Vulnerability: Cross Site Scripting

Description: 
This module provides social media share & follow buttons.

The module doesn't sufficiently restrict AddToAny block settings to users who
have permission to administer AddToAny. This allows users with lower
permission to configure malicious code leading to a Cross Site Scripting
(XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role
with the permission "administer blocks".

Solution: 
Install the latest version:

   * If you use the AddToAny Share Buttons module for Drupal 9.4+ or 10,
     upgrade to AddToAny 2.0.4 [3]
   * If you use the AddToAny Share Buttons module for Drupal versions before
     9.4, upgrade to AddToAny 8.x-1.21 [4]

Reported By: 
   * Mitch Portier [5]

Fixed By: 
   * micropat [6]
   * Vladimir Roudakov [7]
   * Mitch Portier [8]

Coordinated By: 
   * Damien McKenna [9] of the Drupal Security Team


[1] https://www.drupal.org/project/addtoany
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/addtoany/releases/2.0.4
[4] https://www.drupal.org/project/addtoany/releases/8.x-1.21
[5] https://www.drupal.org/user/2284182
[6] https://www.drupal.org/user/260224
[7] https://www.drupal.org/user/673120
[8] https://www.drupal.org/user/2284182
[9] https://www.drupal.org/user/108450