November 2017 - Security-news

bootstrap_carousel - Moderately critical - Cross Site Scripting - SA-CONTRIB-2017-088
by security-news＠drupal.org 29 Nov '17

29 Nov '17

View online: https://www.drupal.org/sa-contrib-2017-088 Project: bootstrap_carousel [1] Version: 7.x-1.x-dev Date: 2017-November-29 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: This module provides a way to make carousels, based on bootstrap-carousel.js. The module doesn't sufficiently handle output of img HTML tag's alt property. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Carousel: Create new content" or any similar node module permissions for creating/editing/removing the module-delivered content type. Solution: Install the latest version: * If you use the bootstrap_carousel module for Drupal 7, upgrade to bootstrap_carousel 7.x-1.2 [3] Reported By: * Tatar Balazs Janos [4] Fixed By: * Tatar Balazs Janos [5] * Jean Kemparski Ribeiro [6] the module maintainer Coordinated By: * Tatar Balazs Janos [7] * Michael Hess [8] of the Drupal Security Team [1] https://www.drupal.org/project/bootstrap_carousel [2] https://www.drupal.org/security-team/risk-levels [3] https://drupal.org/node/2926863 [4] https://www.drupal.org/u/tatarbj [5] https://www.drupal.org/u/tatarbj [6] https://www.drupal.org/user/1975716 [7] https://www.drupal.org/u/tatarbj [8] https://www.drupal.org/u/mlhess

1 0

Services single sign-on client - Critical - Cross-site scripting - SA-CONTRIB-2017-087
by security-news＠drupal.org 29 Nov '17

29 Nov '17

View online: https://www.drupal.org/sa-contrib-2017-087 Project: Services single sign-on client [1] Version: 7.x-1.x-dev Date: 2017-November-29 Security risk: *Critical* 16∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site scripting Description: This module allows users of a remote Services-enabled Drupal site to sign on to a second site with their credentials. The module does not sanitize information from the request before displaying it, thereby exposing a cross-site scripting vulnerability. Solution: Install the latest version: * If you use the Services Single Sign-on Client module for Drupal 7.x, upgrade to Services Single Sign-on Client 7.x-1.6 [3] Reported By: * Scott Allison [4] Fixed By: * Scott Allison [5] * Brandon Stone [6] the module maintainer Coordinated By: * David Rothstein [7] of the Drupal Security Team * Lee Rowlands [8] of the Drupal Security Team [1] https://www.drupal.org/project/services_sso_client [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/services_sso_client/releases/7.x-1.6 [4] https://www.drupal.org/u/scottallison [5] https://www.drupal.org/u/scottallison [6] https://www.drupal.org/u/branana [7] https://www.drupal.org/u/david_rothstein [8] https://www.drupal.org/u/larowlan

1 0

Cloud - Critical - CSRF - SA-CONTRIB-2017-086
by security-news＠drupal.org 29 Nov '17

29 Nov '17

View online: https://www.drupal.org/sa-contrib-2017-086 Project: Cloud [1] Version: 7.x-1.x-dev Date: 2017-November-29 Security risk: *Critical* 18∕25 AC:None/A:User/CI:Some/II:All/E:Theoretical/TD:All [2] Vulnerability: CSRF Description: This module enables sites to manage public clouds like Amazon EC2 and also private clouds like OpenStack. The module doesn't sufficiently protect the deletion of audit reports, thereby exposing a cross-site request vulnerability which can be exploited by unprivileged users to trick an administrator into unwanted deletion of audit reports. This vulnerability is mitigated by the fact that the victim must have a role with the permission "access audit report". Solution: Install the latest version: * If you use the Cloud module for Drupal 7, upgrade to Cloud 7.x-1.7 [3] Reported By: * Tatar Balazs Janos [4] Fixed By: * Tatar Balazs Janos [5] * Yas Naoi [6] the module maintainer Coordinated By: * Tatar Balazs Janos [7] [1] https://www.drupal.org/project/cloud [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/cloud/releases/7.x-1.7 [4] https://www.drupal.org/u/tatarbj [5] https://www.drupal.org/u/tatarbj [6] https://www.drupal.org/u/yas [7] https://www.drupal.org/u/tatarbj

1 0

MoneySuite - Moderately critical - Access bypass - SA-CONTRIB-2017-085
by security-news＠drupal.org 29 Nov '17

29 Nov '17

View online: https://www.drupal.org/sa-contrib-2017-085 Project: MoneySuite [1] Version: 7.x-10.x-dev Date: 2017-November-29 Security risk: *Moderately critical* 14∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Description: MoneySuite provides a set of modules for Drupal sites that rely on the sale of memberships and/or content for revenue. The modules have an access bypass vulnerability which allows untrusted users (including anonymous users) to view payments made by users within the system. No data can be modified, nor are any credit card numbers displayed. Solution: Install the latest version: * If you use the MoneySuite module for Drupal 7.x, upgrade to MoneySuite 7.x-10.4 [3] Reported By: * Anthony Lindsay [4] Fixed By: * Anthony Lindsay [5] * Clive Murden [6] the module maintainer * Farreres [7] the module maintainer Coordinated By: * David Rothstein [8] of the Drupal Security Team [1] https://www.drupal.org/project/moneysuite [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/moneysuite/releases/7.x-10.4 [4] https://www.drupal.org/u/anthonylindsay [5] https://www.drupal.org/u/anthonylindsay [6] https://www.drupal.org/u/clivem [7] https://www.drupal.org/u/farreres [8] https://www.drupal.org/user/124982

1 0

Domain Integration - Moderately critical - Access bypass - SA-CONTRIB-2017-084
by security-news＠drupal.org 29 Nov '17

29 Nov '17

View online: https://www.drupal.org/sa-contrib-2017-084 Project: Domain Integration [1] Version: 7.x-1.x-dev Date: 2017-November-29 Security risk: *Moderately critical* 13∕25 AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: This module enables you to integrate the Domain module with other popular Drupal modules. The Domain Integration Login Restrict sub-module enables you to restrict access to a domain based on the assigned domains on a user. The Domain Integration Login Restrict sub-module doesn't sufficiently check these restrictions when using one-time logins. This vulnerability is mitigated by the fact that an attacker must have an active account on one of the domains. Solution: Install the latest version: * If you use the Domain Integration module for Drupal 7.x, upgrade to Domain Integration 7.x-1.2 [3] Reported By: * Dominique Climenti [4] Fixed By: * Dominique Climenti [5] * Len Swaneveld [6] the module maintainer * Niels de Feyter [7] the module maintainer * David Rothstein [8] of the Drupal Security Team * Michael Hess [9] of the Drupal Security Team Coordinated By: * David Rothstein [10] of the Drupal Security Team [1] https://www.drupal.org/project/domain_integration [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/domain_integration/releases/7.x-1.2 [4] https://www.drupal.org/user/3549871 [5] https://www.drupal.org/user/3549871 [6] https://www.drupal.org/user/690914 [7] https://www.drupal.org/user/599438 [8] https://www.drupal.org/user/124982 [9] https://www.drupal.org/user/102818 [10] https://www.drupal.org/user/124982

1 0

Permissions by Term - Moderately critical - Access bypass - SA-CONTRIB-2017-082
by security-news＠drupal.org 08 Nov '17

08 Nov '17

View online: https://www.drupal.org/sa-contrib-2017-082 Project: Permissions by Term [1] Version: 8.x-1.x-dev Date: 2017-November-08 Security risk: *Moderately critical* 14∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Description: The Permissions by Term module extends Drupal by adding functionality for restricting access to single nodes via taxonomy terms. The module grants access to nodes that are being blocked by other node access modules and that the Permissions by Term module does not intend to control. Additionally, it grants access to unpublished nodes in node listings to users who should not be able to see them. These problems lead to an access bypass vulnerability. This vulnerability is mitigated by the fact that it only occurs on sites that either have another node access module (besides Permissions by Term) in use, or that have node listings that are accessible to unprivileged users and that don't directly filter out unpublished content. Solution: Install the latest version: * If you use the Permissions by Term module for Drupal 8, upgrade to Permissions by Term 8.x-1.35 [3] Reported By: * David Rothstein [4] of the Drupal Security Team Fixed By: * David Rothstein [5] of the Drupal Security Team * Peter Majmesku [6] the module maintainer Coordinated By: * David Rothstein [7] of the Drupal Security Team [1] https://www.drupal.org/project/permissions_by_term [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/permissions_by_term/releases/8.x-1.35 [4] https://www.drupal.org/u/david_rothstein [5] https://www.drupal.org/u/david_rothstein [6] https://www.drupal.org/u/peter-majmesku [7] https://www.drupal.org/user/124982

1 0

Custom Permissions - Moderately critical - Access bypass - SA-CONTRIB-2017-083
by security-news＠drupal.org 08 Nov '17

08 Nov '17

View online: https://www.drupal.org/sa-contrib-2017-083 Project: Custom Permissions [1] Version: 8.x-1.x-dev Date: 2017-November-08 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: Custom Permissions is a lightweight module that allows permissions to be created and managed through an administrative form. When this module is in use, any user who is able to perform an action which rebuilds some of Drupal's caches can trigger a scenario in which certain pages protected by this module's custom permissions temporarily lose those custom access controls, thereby leading to an access bypass vulnerability. Solution: Install the latest version: * If you use the Custom Permissions module for Drupal 8, upgrade to Custom Permissions 8.x-1.1 [3] Reported By: * Michael Koza [4] * David Rothstein [5] of the Drupal Security Team Fixed By: * David Valdez [6] the module maintainer * David Rothstein [7] of the Drupal Security Team Coordinated By: * David Rothstein [8] of the Drupal Security Team [1] https://www.drupal.org/project/config_perms [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/config_perms/releases/8.x-1.1 [4] https://www.drupal.org/user/2110062 [5] https://www.drupal.org/user/124982 [6] http://drupal.org/u/gnuget [7] https://www.drupal.org/user/124982 [8] https://www.drupal.org/user/124982

1 0

Automated Logout - Moderately critical - Cross Site Scripting - SA-CONTRIB-2017-081
by security-news＠drupal.org 01 Nov '17

01 Nov '17

View online: https://www.drupal.org/sa-contrib-2017-081 Project: Automated Logout [1] Version: 7.x-4.x-dev Date: 2017-November-01 Security risk: *Moderately critical* 14∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Cross Site Scripting Description: This module provides a site administrator the ability to log users out after a specified time of inactivity. It is highly customizable and includes "site policies" by role to enforce log out. The module does not sufficiently filter user-supplied text that is stored in the configuration, resulting in a persistent Cross Site Scripting vulnerability (XSS). This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer autologout". Solution: Install the latest version: * If you use the Automated Logout module for Drupal 7, upgrade to Automated Logout 7.x-4.5 [3] Reported By: * Nancy Wichmann [4] Fixed By: * Nancy Wichmann [5] * Ajit Shinde [6] the module maintainer Coordinated By: * David Snopek [7] of the Drupal Security Team [1] https://www.drupal.org/project/autologout [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/autologout/releases/7.x-4.5 [4] https://www.drupal.org/u/nancydru [5] https://www.drupal.org/u/nancydru [6] https://www.drupal.org/u/ajits [7] https://www.drupal.org/user/u/dsnopek

1 0