SA-CONTRIB-2012-155 - ShareThis - Cross Site Scripting (XSS)

This module enables integration with the ShareThis web service to allow social bookmarking amongst your users.
The module doesn’t sufficiently filter JavaScript settings before outputting them.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission “administer sharethis”.

CVE: CVE-2012-5545

Versions affected

• ShareThis 7.x-2.x versions prior to 7.x-2.5.

Drupal core is not affected. If you do not use the contributed ShareThis module, there is nothing you need to do.

Solution

Install the latest version:

• If you use the ShareThis module for Drupal 7.x, upgrade to ShareThis 7.x-2.5

Also see the ShareThis project page.

Reported by

• Jake Bell

Fixed by

• Rob Loach, the module maintainer

Coordinated by

• David Stoline provisional member of the Drupal Security Team
• Ben Jeavons of the Drupal Security Team
• Greg Knaddison of the Drupal Security Team