Description
Cross-site scripting (XSS) vulnerability in block_class.module in the Block Class module before 7.x-1.1 for Drupal allows remote authenticated users with certain permissions to inject arbitrary web script or HTML via the class name.
References
- 52341 vdb-entry
- 79851 vdb-entry
- 48298 third-party-advisory
- http://drupal.org/node/1471090
- [oss-security] 20120406 CVE's for Drupal Contrib 2012 001 through 057 (67 new CVE assignments) mailing-list
- http://drupalcode.org/project/block_class.git/commit/9a5205d
- blockclass-addmod-class-xss(73776) vdb-entry
- http://drupal.org/node/1471808