CVE-2025-3902: Block Class - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-043
Published Apr 23, 2025
·Updated
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Drupal Block Class allows Cross-Site Scripting (XSS).This issue affects Block Class: from 4.0.0 before 4.0.1.
Affected Software
2 affected components
Drupal Block Class>=4.0.0<4.0.1
Four Kitchens Block Class Drupal>=4.0.0<4.0.1
Event History
Apr 23, 2025
CVE Published
via MITRE·05:08 PM
Data Sourced
via MITRE·05:08 PM
DescriptionWeakness
Data Sourced
via NVD·05:16 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-3902?
CVE-2025-3902 is classified as a medium severity vulnerability due to its potential for Cross-Site Scripting (XSS) attacks.
2
How do I fix CVE-2025-3902?
To fix CVE-2025-3902, update Drupal Block Class to version 4.0.1 or later.
3
What systems are affected by CVE-2025-3902?
CVE-2025-3902 affects Drupal Block Class versions from 4.0.0 before 4.0.1.
4
What type of vulnerability is CVE-2025-3902?
CVE-2025-3902 is an improper neutralization of input during web page generation vulnerability, specifically a Cross-Site Scripting (XSS) issue.
5
What is the impact of exploiting CVE-2025-3902?
Exploiting CVE-2025-3902 can allow an attacker to execute arbitrary scripts in the context of a user's session.