January 2015 - Security-news - lists.drupal.org

SA-CONTRIB-2015-033 - Certify - Access bypass and information disclosure
by security-news＠drupal.org 28 Jan '15

28 Jan '15

View online: https://www.drupal.org/node/2415947 * Advisory ID: DRUPAL-SA-CONTRIB-2015-033 * Project: Certify [1] (third-party module) * Version: 6.x * Date: 2015-January-28 * Security risk: 11/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:All [2] * Vulnerability: Access bypass, Information Disclosure, Multiple vulnerabilities -------- DESCRIPTION --------------------------------------------------------- Certify enables you to automatically issue PDF certificates to users upon completion of a set of conditions. The module does not sufficiently check node access when showing (and creating) the PDF certificates. This can lead to users seeing certificates they should not have access to. This vulnerability is mitigated by the fact that an attacker must have completed the conditions of the certificate. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Certify 6.x-2.x versions prior to 6.x-2.3. Drupal core is not affected. If you do not use the contributed Certify [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Certify module for Drupal 6.x, upgrade to Certify 6.x-2.3 [5] Also see the Certify [6] project page. -------- REPORTED BY --------------------------------------------------------- * Jim Gauthier [7] -------- FIXED BY ------------------------------------------------------------ * Håvard Pedersen [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Ben Dougherty [9] provisional member of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [14] [1] https://www.drupal.org/project/certify [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/certify [5] https://www.drupal.org/node/2407081 [6] https://www.drupal.org/project/certify [7] https://www.drupal.org/user/3087489 [8] https://www.drupal.org/user/239588/ [9] https://www.drupal.org/user/1852732 [10] https://www.drupal.org/contact [11] https://www.drupal.org/security-team [12] https://www.drupal.org/writing-secure-code [13] https://www.drupal.org/security/secure-configuration [14] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2015-032 - Node Invite - Multiple vulnerabilities
by security-news＠drupal.org 28 Jan '15

28 Jan '15

View online: https://www.drupal.org/node/2415899 * Advisory ID: DRUPAL-SA-CONTRIB-2015-032 * Project: Node Invite [1] (third-party module) * Version: 6.x * Date: 2015-January-28 * Security risk: 15/25 ( Critical) AC:None/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] * Vulnerability: Cross Site Scripting, Cross Site Request Forgery, Open Redirect, Multiple vulnerabilities -------- DESCRIPTION --------------------------------------------------------- Node Invite module enables you to invite people to RSVP on node types that have been configured to represent events. The module doesn't sufficiently sanitize the titles of nodes in some listings, allowing a malicious user to inject code, thereby leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that the attacker must have permission to create or edit nodes configured to be used for RSVP. Additionally, some URLs are not protected against CSRF. A malicious user can cause a user with the "node_invite_can_manage_invite" permission to re-enable node invitations by getting his browser to make a request to a specially-crafted URL. Lastly, the module is not checking that some destination parameters are internal URLs, thereby leading to an Open Redirect vulnerability. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Node Invite 6.x-2.x versions prior to 6.x-2.5. Drupal core is not affected. If you do not use the contributed Node Invite [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Node Invite module for Drupal 6.x, upgrade to Node Invite 6.x-2.5 [5] Also see the Node Invite [6] project page. -------- REPORTED BY --------------------------------------------------------- * Pere Orga [7] provisional member of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Scott Hadfield [8] the module maintainer * Pere Orga [9] provisional member of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * Pere Orga [10] provisional member of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [15] [1] https://www.drupal.org/project/node_invite [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/node_invite [5] https://www.drupal.org/node/2415541 [6] https://www.drupal.org/project/node_invite [7] https://www.drupal.org/user/2301194 [8] https://www.drupal.org/user/67093 [9] https://www.drupal.org/user/2301194 [10] https://www.drupal.org/user/2301194 [11] https://www.drupal.org/contact [12] https://www.drupal.org/security-team [13] https://www.drupal.org/writing-secure-code [14] https://www.drupal.org/security/secure-configuration [15] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2015-031 - GD Infinite Scroll - Multiple vulnerabilites
by security-news＠drupal.org 28 Jan '15

28 Jan '15

View online: https://www.drupal.org/node/2415885 * Advisory ID: DRUPAL-SA-CONTRIB-2015-031 * Project: GD Infinite Scroll [1] (third-party module) * Version: 7.x * Date: 2015-January-28 * Security risk: 14/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] * Vulnerability: Cross Site Scripting, Cross Site Request Forgery, Multiple vulnerabilities -------- DESCRIPTION --------------------------------------------------------- GD Infinite Scroll module enables you to use the "infinite scroll jQuery plugin : auto-pager" on custom pages. Some links were not protected against CSRF. A malicious user could cause another user with the "edit gd infinite scroll settings" permission to delete settings by getting his browser to make a request to a specially-crafted URL. Also, the module fails to sanitize user input in its admin page, leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "edit gd infinite scroll settings". -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- All GD Infinite Scroll versions prior to 7.x-1.4 Drupal core is not affected. If you do not use the contributed GD Infinite Scroll [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version, upgrade to GD Infinite Scroll 7.x-1.4 [5] Also see the GD Infinite Scroll [6] project page. -------- REPORTED BY --------------------------------------------------------- * Pere Orga [7] provisional member of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Vincent Baronnet [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Pere Orga [9] provisional member of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [14] [1] https://www.drupal.org/project/gd_infinite_scroll [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/gd_infinite_scroll [5] http://www.drupal.org/node/2415219 [6] https://www.drupal.org/project/gd_infinite_scroll [7] https://www.drupal.org/user/2301194 [8] https://www.drupal.org/user/1270276 [9] https://www.drupal.org/user/2301194 [10] https://www.drupal.org/contact [11] https://www.drupal.org/security-team [12] https://www.drupal.org/writing-secure-code [13] https://www.drupal.org/security/secure-configuration [14] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2015-030 - Amazon AWS - Access bypass
by security-news＠drupal.org 28 Jan '15

28 Jan '15

View online: https://www.drupal.org/node/2415873 * Advisory ID: DRUPAL-SA-CONTRIB-2015-030 * Project: Amazon AWS [1] (third-party module) * Version: 7.x * Date: 2015-January-28 * Security risk: 14/25 ( Moderately Critical) AC:None/A:None/CI:None/II:Some/E:Theoretical/TD:Default [2] * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- Amazon AWS module provides integration with Amazon Web Services (AWS). A malicious user could potentially guess an access token and trigger the creation of new backups by making a request to a specially-crafted URL. If the number of stored backups was limited, an attacker could exceed the limit by calling the URL multiple times, thereby resulting in the loss of older backup states that would get replaced with the newly generated ones. This vulnerability is mitigated by the fact that an attacker must know the AWS Access Key Id (these are not secret). -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Amazon AWS versions prior to 7.x-1.3. Drupal core is not affected. If you do not use the contributed Amazon AWS [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Amazon AWS module for Drupal 7, upgrade to Amazon AWS 7.x-1.3 [5] Also see the Amazon AWS [6] project page. -------- REPORTED BY --------------------------------------------------------- * Pere Orga [7] provisional member of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Sudhir Krishna [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Pere Orga [9] provisional member of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [14] [1] https://www.drupal.org/project/aws_amazon [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/aws_amazon [5] https://www.drupal.org/node/2415457 [6] https://www.drupal.org/project/aws_amazon [7] https://www.drupal.org/user/2301194 [8] https://www.drupal.org/user/554988 [9] https://www.drupal.org/user/2301194 [10] https://www.drupal.org/contact [11] https://www.drupal.org/security-team [12] https://www.drupal.org/writing-secure-code [13] https://www.drupal.org/security/secure-configuration [14] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2015-029 - Corner - Cross Site Request Forgery (CSRF) - Unsupported
by security-news＠drupal.org 22 Jan '15

22 Jan '15

View online: https://www.drupal.org/node/2411741 * Advisory ID: DRUPAL-SA-CONTRIB-2015-029 * Project: Corner [1] (third-party module) * Version: 6.x * Date: 2015-January-21 * Security risk: 13/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] * Vulnerability: Cross Site Request Forgery -------- DESCRIPTION --------------------------------------------------------- This module enables you to add configurable corners to your site. A malicious user can cause an administrator to enable and disable corners by getting the administrator's browser to make a request to a specially-crafted URL while the administrator is logged in. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * All versions of Corner module Drupal core is not affected. If you do not use the contributed Corner [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ If you use the Corner module you should uninstall it. Also see the Corner [5] project page. -------- REPORTED BY --------------------------------------------------------- * Pere Orga [6] provisional member of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ Not applicable. -------- COORDINATED BY ------------------------------------------------------ * Pere Orga [7] provisional member of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [8]. Learn more about the Drupal Security team and their policies [9], writing secure code for Drupal [10], and securing your site [11]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [12] [1] https://www.drupal.org/project/corner [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/corner [5] https://www.drupal.org/project/corner [6] https://www.drupal.org/user/2301194 [7] https://www.drupal.org/user/2301194 [8] https://www.drupal.org/contact [9] https://www.drupal.org/security-team [10] https://www.drupal.org/writing-secure-code [11] https://www.drupal.org/security/secure-configuration [12] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2015-028 - Shibboleth Authentication - Cross Site Request Forgery (CSRF)
by security-news＠drupal.org 22 Jan '15

22 Jan '15

View online: https://www.drupal.org/node/2411737 * Advisory ID: DRUPAL-SA-CONTRIB-2015-028 * Project: Shibboleth authentication [1] (third-party module) * Version: 6.x, 7.x * Date: 2015-January-21 * Security risk: 13/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] * Vulnerability: Cross Site Request Forgery -------- DESCRIPTION --------------------------------------------------------- Shibboleth Authentication module allows users to log in and get permissions based on federated (SAML2) authentication. The roles that are assigned to users are based on a matching list. A malicious attacker can delete matching rules from the list by getting the administrator's browser to make a request to a specially-crafted URL while the administrator is logged in. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Shibboleth Authentication 6.x-4.x versions prior to 6.x-4.1. * Shibboleth Authentication 7.x-4.x versions prior to 7.x-4.1. Drupal core is not affected. If you do not use the contributed Shibboleth authentication [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Shibboleth Authentication module for Drupal 6.x, upgrade to 6.x-4.1 [5] * If you use the Shibboleth Authentication module for Drupal 7.x, upgrade to 7.x-4.1 [6] Also see the Shibboleth authentication [7] project page. -------- REPORTED BY --------------------------------------------------------- * Pere Orga [8] provisional member of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Zoltán Kiss [9] and Kristof Bajnok [10] the module maintainers -------- COORDINATED BY ------------------------------------------------------ * Pere Orga [11] provisional member of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [16] [1] https://www.drupal.org/project/shib_auth [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/shib_auth [5] https://www.drupal.org/node/2411269 [6] https://www.drupal.org/node/2411271 [7] https://www.drupal.org/project/shib_auth [8] https://www.drupal.org/user/2301194 [9] https://www.drupal.org/user/496918 [10] https://www.drupal.org/user/250470 [11] https://www.drupal.org/user/2301194 [12] https://www.drupal.org/contact [13] https://www.drupal.org/security-team [14] https://www.drupal.org/writing-secure-code [15] https://www.drupal.org/security/secure-configuration [16] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2015-027 - Quizzler - Cross Site Scripting (XSS)
by security-news＠drupal.org 22 Jan '15

22 Jan '15

View online: https://www.drupal.org/node/2411579 * Advisory ID: DRUPAL-SA-CONTRIB-2015-027 * Project: Quizzler [1] (third-party module) * Version: 7.x * Date: 2015-January-21 * Security risk: 13/25 ( Moderately Critical) AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Quizzler module allows you to create online quizzes and tests. Quizzes are nodes with questions attached. The module does not sanitize user input in the node title when displaying it on the page, allowing a malicious user to inject code, a Cross Site Scripting (XSS) attack. This vulnerability is mitigated by the fact that an attacker must have a role that allows them to create nodes or edit nodes that are assigned as quizzes. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * All versions prior to 7.x-1.16. Drupal core is not affected. If you do not use the contributed Quizzler [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Quizzler module, upgrade to Quizzler 7-x.1.16 [5] Also see the Quizzler [6] project page. -------- REPORTED BY --------------------------------------------------------- * Pere Orga [7] provisional member of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Aaron Craig [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Pere Orga [9] provisional member of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [14] [1] https://www.drupal.org/project/quizzler [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/quizzler [5] https://www.drupal.org/node/2410399 [6] https://www.drupal.org/project/quizzler [7] https://www.drupal.org/user/2301194 [8] https://www.drupal.org/user/118575 [9] https://www.drupal.org/user/2301194 [10] https://www.drupal.org/contact [11] https://www.drupal.org/security-team [12] https://www.drupal.org/writing-secure-code [13] https://www.drupal.org/security/secure-configuration [14] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2015-026 - Taxonews - Cross Site Scripting (XSS)
by security-news＠drupal.org 22 Jan '15

22 Jan '15

View online: https://www.drupal.org/node/2411573 * Advisory ID: DRUPAL-SA-CONTRIB-2015-026 * Project: Taxonews [1] (third-party module) * Version: 5.x, 6.x, 7.x * Date: 2015-January-21 * Security risk: 13/25 ( Moderately Critical) AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module enables you to create blocks of nodes carrying a given taxonomy term. The module doesn't sufficiently escape term names in the blocks it builds leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer taxonomy" or the ability to create terms in some other way. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Taxonews 7.x-1.x versions prior to 7.x-1.1. * Taxonews 6.x-1.x versions prior to 6.x-1.2. Drupal core is not affected. If you do not use the contributed Taxonews [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version of Taxonews module: * For Drupal 7.x, upgrade to Taxonews 7.x-1.1 [5] * For Drupal 6.x, upgrade to Taxonews 6.x-1.2 [6] Also see the Taxonews [7] project page. -------- REPORTED BY --------------------------------------------------------- * Pere Orga [8] provisional member of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * FGM [9] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Pere Orga [10] provisional member of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [15] [1] https://www.drupal.org/project/taxonews [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/taxonews [5] https://www.drupal.org/node/2409769 [6] https://www.drupal.org/node/2409767 [7] https://www.drupal.org/project/taxonews [8] https://www.drupal.org/user/2301194 [9] https://www.drupal.org/user/27985 [10] https://www.drupal.org/user/2301194 [11] https://www.drupal.org/contact [12] https://www.drupal.org/security-team [13] https://www.drupal.org/writing-secure-code [14] https://www.drupal.org/security/secure-configuration [15] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2015-025 - Patterns - Cross Site Request Forgery (CSRF)
by security-news＠drupal.org 22 Jan '15

22 Jan '15

View online: https://www.drupal.org/node/2411539 * Advisory ID: DRUPAL-SA-CONTRIB-2015-025 * Project: Patterns [1] (third-party module) * Version: 7.x * Date: 2015-January-21 * Security risk: 13/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] * Vulnerability: Cross Site Request Forgery -------- DESCRIPTION --------------------------------------------------------- Patterns module manages and automates site configuration. Site configurations stored in XML or YAML are called Patterns, and these are easy to read, modify, manage & share and can be executed manually or as a part of an automated web site deployment. Some links were not protected against CSRF. A malicious user could cause an administrator to restore, publish and unpublish patterns by getting the administrator's browser to make a request to a specially-crafted URL. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Patterns 7.x-2.x versions prior to 7.x-2.2. Drupal core is not affected. If you do not use the contributed Patterns [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Patterns module for Drupal 7.x, upgrade to Patterns 7.x-2.2 [5] Also see the Patterns [6] project page. -------- REPORTED BY --------------------------------------------------------- * Pere Orga [7] provisional member of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * David Rozas [8], one of the module maintainers -------- COORDINATED BY ------------------------------------------------------ * Pere Orga [9] provisional member of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [14] [1] https://www.drupal.org/project/patterns [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/patterns [5] https://www.drupal.org/node/2411507 [6] https://www.drupal.org/project/patterns [7] https://www.drupal.org/user/2301194 [8] https://www.drupal.org/user/740628 [9] https://www.drupal.org/user/2301194 [10] https://www.drupal.org/contact [11] https://www.drupal.org/security-team [12] https://www.drupal.org/writing-secure-code [13] https://www.drupal.org/security/secure-configuration [14] https://twitter.com/drupalsecurity

1 0

SA-CONTRIB-2015-024 - Alfresco - Cross Site Request Forgery (CSRF)
by security-news＠drupal.org 22 Jan '15

22 Jan '15

View online: https://www.drupal.org/node/2411523 * Advisory ID: DRUPAL-SA-CONTRIB-2015-0XX * Project: Alfresco [1] (third-party module) * Version: 6.x * Date: 2015-January-21 * Security risk: 13/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] * Vulnerability: Cross Site Request Forgery -------- DESCRIPTION --------------------------------------------------------- The Alfresco module provides integration between Drupal and Alfresco via Content Management Web Services (SOAP) and Repository RESTful API. The Alfresco Browser submodule provides an AJAX-based repository browser that allows users to visualize, upload, search and retrieve nodes from the Alfresco repository. Some links from Alfresco Browser were not properly protected from CSRF. A malicious user could cause a user to delete alfresco nodes by getting the user's browser to make a request to a specially-crafted URL while the user was logged in. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Alfresco 6.x-1.x versions prior to 6.x-1.3. Drupal core is not affected. If you do not use the contributed Alfresco [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Alfresco module for Drupal 6.x, upgrade to Alfresco 6.x-1.3 [5] Also see the Alfresco [6] project page. -------- REPORTED BY --------------------------------------------------------- * Pere Orga [7] provisional member of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Sergio Martín Morillas [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Pere Orga [9] provisional member of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [14] [1] https://www.drupal.org/project/alfresco [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/alfresco [5] https://www.drupal.org/node/2411501 [6] https://www.drupal.org/project/alfresco [7] https://www.drupal.org/user/2301194 [8] https://www.drupal.org/user/191570 [9] https://www.drupal.org/user/2301194 [10] https://www.drupal.org/contact [11] https://www.drupal.org/security-team [12] https://www.drupal.org/writing-secure-code [13] https://www.drupal.org/security/secure-configuration [14] https://twitter.com/drupalsecurity

1 0