DRUPAL-CONTRIB-2019-039 This module enables you to add social media share buttons on your website to its content and pages.
An attacker with admin settings access can inject scripts via the AddToAny module, potentially compromising user sessions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is DRUPAL-CONTRIB-2019-039?
DRUPAL-CONTRIB-2019-039 is a cross-site scripting vulnerability in drupal/addtoany, published on 20 Mar 2019. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
This module enables you to add social media share buttons on your website to its content and pages.
The module doesn't sufficiently mark its administration permission restricted, allowing cross site scripting vulnerabilities to users who have access to its admin settings.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer addtoany".
This advisory was edited on March 25th to add the affected 8.x-1.11 release.
Which versions are affected by DRUPAL-CONTRIB-2019-039?
Linux distribution packages (1)
drupal/addtoany Packagist:https://packages.drupal.org/8 | All versions | 1.11.0 |
How do I fix DRUPAL-CONTRIB-2019-039?
Upgrade to a fixed version.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is DRUPAL-CONTRIB-2019-039 being exploited?
There is no known exploitation of DRUPAL-CONTRIB-2019-039 in the wild and no public exploit code.