SA-CONTRIB-2012-045 - AddToAny - Cross Site Scripting

CVE: CVE-2012-2072

This module enables you to add Lockerz/AddToAny’s universal sharing buttons to your site.
Previously, the module did not sanitize some of the user-supplied data before displaying it, leading to a Cross Site Scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission “administer addtoany”.

Versions affected

• 6.x-3.x versions prior to 6.x-3.4

Drupal core is not affected. If you do not use the contributed Share Buttons (AddToAny) by Lockerz module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the Lockerz/AddToAny module for Drupal 6.x, upgrade to version 6.x-3.4

Also see the Share Buttons (AddToAny) by Lockerz project page.

Reported by

• Kyle Small

Fixed by

• micropat — one of the module’s maintainers

Coordinated by

• Michael Hess of the Drupal Security Team