{"id":"DRUPAL-CONTRIB-2023-019","aliases":[],"status":"published","description":"This module provides social media share \u0026 follow buttons.\n\nThe module doesn't sufficiently restrict AddToAny block settings to users who have permission to administer AddToAny. This allows users with lower permission to configure malicious code leading to a Cross Site Scripting (XSS) vulnerability.\n\nThis vulnerability is mitigated by the fact that an attacker must have a role with the permission \"administer blocks\".","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-05-31T13:22:44Z","modified":"2026-09-10T03:45:06Z","fixes":[{"ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/addtoany","fixed_in":["1.21.0","2.0.4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Packagist:https://packages.drupal.org/8","package":"drupal/addtoany","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.0"}]},{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.4"}]}]}],"references":[{"url":"https://www.drupal.org/sa-contrib-2023-019","tags":["web"]}],"sources":{"osv":[{"id":"DRUPAL-CONTRIB-2023-019","description":"This module provides social media share \u0026 follow buttons.\n\nThe module doesn't sufficiently restrict AddToAny block settings to users who have permission to administer AddToAny. This allows users with lower permission to configure malicious code leading to a Cross Site Scripting (XSS) vulnerability.\n\nThis vulnerability is mitigated by the fact that an attacker must have a role with the permission \"administer blocks\".","status":"published","published":"2023-05-31T13:22:44Z","modified":"2026-09-10T03:45:06.635887674Z","updated_at":"2026-11-02T15:46:13.584509Z"}]}}