Better Social Sharing Buttons - Less critical - Cross Site Scripting - SA-CONTRIB-2023-006

Project: Better Social Sharing ButtonsDate: 2023-March-01Security risk: Less critical 8∕25 AC:Basic/A:User/CI:None/II:None/E:Theoretical/TD:AllVulnerability: Cross Site ScriptingDescription: This module enables you to add social sharing buttons to a site.
The module doesn't sufficiently sanitize the weight and ratio values entered in the module or block configuration.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer blocks".Solution: Install the latest version:

• If you use the Better Social Sharing Buttons module for Drupal 9 or 10, upgrade to Better Social Sharing Buttons 4.0.3

Reported By: 

• cydave

Fixed By: 

• cydave
• Shelane French

Coordinated By: 

• Damien McKenna of the Drupal Security Team