Description
The Block Title Link module lets a site editor attach a link to a block title and supports replacement tokens inside that link.
The module performs the token replacement against the global account of whoever is viewing the block, so the value substituted into the link is the private token value of the visitor and not of the editor who configured it. An editor who holds the set block title links permission can therefore store a link that points at a host they control and carries a personal token, and every visitor who follows that title link sends their own token value, such as their email address or their one time login URL where the installed token module implements it, to that host.
This vulnerability is mitigated by the fact that the set block title links permission must be granted to the attacking role and that a visitor must follow the crafted title link before any value leaves the site.
Solution
Install the latest version.
If you use the Block Title Link module for Drupal 7, upgrade to Block Title Link 7.x-1.6:
Reported by
Fixed by
- Tag1 D7ES
Coordinated by
- Tag1 D7ES