SA-CONTRIB-2012-032 - Block Class - Cross Site scripting

CVE: CVE-2012-1657

The block class module allows users to add classes to any block through the block’s configuration interface

The class names in a block were not properly filtered. Someone with the ability to modify or create blocks could inject java script that would be rendered when viewing the block.

Versions affected

• Blockclass versions prior to 7.x-1.0.

Drupal core is not affected. If you do not use the contributed Block Class module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the block class module for Drupal 7.x, upgrade to block class 7.x-1.1

See also the Block Class project page.

Reported by

• Katherine Senzee

Fixed by

• Berend de Boer the module maintainer

Coordinated by

• Michael Hess of the Drupal Security Team