SA-CONTRIB-2012-043 - MultiBlock - Cross Site Scripting

CVE: CVE-2012-2070

The MultiBlock module allows an administrator to create multiple instances of blocks provided by other modules. The module does not properly sanitize the block title provided by a block administrator, leading to a cross-site scripting (XSS) vulnerability. Such an attack may lead to a malicious user gaining full administrative access. A user must have a role with the permission ‘administer blocks’ to exploit this vulnerability.

Versions affected

• MultiBlock 6.x-1.x versions prior to 6.x-1.4.
• MultiBlock 7.x-1.x versions prior to 7.x-1.1.

Drupal core is not affected. If you do not use the contributed MultiBlock module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the MultiBlock module for Drupal 6.x, upgrade to MultiBlock 6.x-1.4
• If you use the MultiBlock module for Drupal 7.x, upgrade to MultiBlock 7.x-1.1

Also see the MultiBlock project page.

Reported by

• Justin Klein Keane

Fixed by

• Andrew Levine the module maintainer

Coordinated by

• Ivo Van Geertruyen of the Drupal Security Team
• Michael Hess of the Drupal Security Team