October 2017 - Security-news - lists.drupal.org

Mosaik - Moderately critical - Cross-site scripting - SA-CONTRIB-2017-080
by security-news＠drupal.org 25 Oct '17

25 Oct '17

View online: https://www.drupal.org/sa-contrib-2017-080 Project: Mosaik [1] Version: 7.x-1.x-dev Date: 2017-October-25 Security risk: *Moderately critical* 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross-site scripting Description: The Mosaik module enables you to create pages or complex blocks in Drupal with the logic of a real mosaic and its pieces. The module doesn't sufficiently sanitize the titles of fieldsets on its administration pages or the titles of blocks that it creates. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer mosaik". Solution: Install the latest version: * If you use the Mosaik module for Drupal 7, upgrade to Mosaik 7.x-1.2 [3] Also see the Mosaik [4] project page. Reported By: * Tatar Balazs Janos [5] Fixed By: * Tatar Balazs Janos [6] * Adriano Cori [7], the module maintainer Coordinated By: * David Rothstein [8] of the Drupal Security Team [1] https://www.drupal.org/project/mosaik [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/mosaik/releases/7.x-1.2 [4] https://www.drupal.org/project/mosaik [5] https://www.drupal.org/u/tatarbj [6] https://www.drupal.org/u/tatarbj [7] https://www.drupal.org/user/805228 [8] https://www.drupal.org/user/124982

1 0

Brilliant Gallery - Highly critical - Multiple Vulnerabilities - SA-CONTRIB-2017-079
by security-news＠drupal.org 25 Oct '17

25 Oct '17

View online: https://www.drupal.org/sa-contrib-2017-079 Project: Brilliant Gallery [1] Version: 7.x-1.x-dev Date: 2017-October-25 Security risk: *Highly critical* 20∕25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Multiple Vulnerabilities Description: This module enables you to display any number of galleries based on images located in the files folder. The module doesn't sufficiently sanitize various database queries which may allow attackers to craft requests resulting in an SQL injection vulnerability. This vulnerability could be exploited even by anonymous users and could potentially allow them to take over the site. The module doesn't sufficiently confirm a user's intent to save checklist data, which allows for a cross-site request forgery (CSRF) exploit to be executed by unprivileged users. Some configuration fields are not filtered while rendered, resulting in a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer Brilliant Gallery". Solution: Install the latest version: * If you use the Brilliant Gallery module for Drupal 7, upgrade to Brilliant Gallery 7.x-1.10 [3] Reported By: * Jean-François Hovinne [4] Fixed By: * Tomas Fulopp [5], the module maintainer Coordinated By: * Greg Knaddison [6] of the Drupal Security Team [1] https://www.drupal.org/project/brilliant_gallery [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/brilliant_gallery/releases/7.x-1.10 [4] https://www.drupal.org/u/jfhovinne [5] https://www.drupal.org/u/vacilando [6] https://www.drupal.org/u/greggles

1 0

Yandex.Metrics - Moderately critical - Cross site scripting - SA-CONTRIB-2017-78
by security-news＠drupal.org 18 Oct '17

18 Oct '17

View online: https://www.drupal.org/sa-contrib-2017-78 Project: Yandex.Metrics [1] Version: 7.x-3.x-dev7.x-2.x-dev7.x-1.x-dev Date: 2017-October-18 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Description: The Yandex.Metrics module allows you to look for key indicators of your site effectiveness. The module doesn't sufficiently let users know a setting page should not be given to untrusted users. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer Yandex.Metrics settings." Solution: Install the latest version: * If you use the Yandex.Metrics module for Drupal 7.x, upgrade to its 7.x-3.1 [3] Also see the Yandex.Metrics [4] project page. Reported By: * Tatar Balazs Janos [5] Fixed By: * Tatar Balazs Janos [6] * Konstantin Komelin [7] the module maintainer Coordinated By: * Michael Hess [8] of the Drupal Security Team * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/yandex_metrics [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/yandex_metrics/releases/7.x-3.1 [4] https://www.drupal.org/project/yandex_metrics [5] https://www.drupal.org/u/tatarbj [6] https://www.drupal.org/u/tatarbj [7] https://www.drupal.org/user/1195752 [8] https://www.drupal.org/u/mlhess [9] https://www.drupal.org/u/greggles

1 0

netFORUM Authentication - Moderately critical - Access Bypass - SA-CONTRIB-2017-077
by security-news＠drupal.org 11 Oct '17

11 Oct '17

View online: https://www.drupal.org/node/2915530 Project: netFORUM Authentication [1] Version: 7.x-1.0 Date: 2017-October-11 Security risk: *Moderately critical* 12∕25 AC:None/A:None/CI:None/II:None/E:Theoretical/TD:All [2] Vulnerability: Access Bypass Description: The netFORUM Authentication module implements external authentication for users against netFORUM. The module does not correctly use flood control making it susceptible to brute force attacks. Solution: Install the latest version: * If you use the netFORUM Authentication module for Drupal 7.x, upgrade to netFORUM Authentication 7.x-1.1 [3] Reported By: * William Hurley [4] Coordinated By: * Cash Williams [5] of the Drupal Security Team Fixed By: * William Hurley [6] [1] https://www.drupal.org/project/netforum_authentication [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/netforum_authentication/releases/7.x-1.1 [4] https://www.drupal.org/user/wwhurley [5] https://www.drupal.org/u/cashwilliams [6] https://www.drupal.org/u/wwhurley

1 0