May 2018 - Security-news - lists.drupal.org

SVG Formatter - Critical - Cross Site Scripting - SA-CONTRIB-2018-027
by security-news＠drupal.org 09 May '18

09 May '18

View online: https://www.drupal.org/sa-contrib-2018-027 Project: SVG Formatter [1] Date: 2018-May-09 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Cross Site Scripting Description: This module adds a new formatter for the file fields, which allows any file extension to be uploaded. The module doesn't sufficiently handle sanitization under the scenario uploaded SVG files. This vulnerability is mitigated by the fact that an attacker must have a role with the permission create or edit on certain content types that allows SVG files to be uploaded. Solution: Install the latest version: * If you use the SVG Formatter module for Drupal 8.x, upgrade to SVG Formatter 8.x-1.06 [3] Also see the SVG Formatter [4] project page. Reported By: * Balazs Janos Tatar [5] Fixed By: * Balazs Janos Tatar [6] * Rick Manelius [7] of the Drupal Security Team * Goran Nikolovski [8] Coordinated By: * Balazs Janos Tatar [9] [1] https://www.drupal.org/project/svg_formatter [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/svg_formatter/releases/8.x-1.06 [4] https://www.drupal.org/project/svg_formatter [5] https://www.drupal.org/user/649590 [6] https://www.drupal.org/user/649590 [7] https://www.drupal.org/user/680072 [8] https://www.drupal.org/user/3451979 [9] https://www.drupal.org/user/649590

1 0

Multi-Step Registration - Critical - Unsupported Module - SA-CONTRIB-2018-023
by security-news＠drupal.org 09 May '18

09 May '18

View online: https://www.drupal.org/sa-contrib-2018-023 Project: Multi-Step Registration [1] Date: 2018-May-09 Security risk: *Critical* 16∕25 AC:None/A:User/CI:Some/II:Some/E:Proof/TD:Default [2] Vulnerability: Unsupported Module Description: With Multi-Step Registration you can create multi-step (wizard) user account registration forms. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466 [3]. The security team marks all unsupported modules critical by default. Solution: If you use the step module for Drupal you should uninstall it. Reported By: Ayesh Karunaratne [4] Fixed By: N/A [1] https://www.drupal.org/project/step [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466 [4] https://www.drupal.org/u/Ayesh

1 0

KCFinder integration - Critical - Unsupported Module - SA-CONTRIB-2018-024
by security-news＠drupal.org 09 May '18

09 May '18

View online: https://www.drupal.org/sa-contrib-2018-024 Project: KCFinder integration [1] Date: 2018-May-09 Security risk: *Critical* 16∕25 AC:None/A:User/CI:Some/II:Some/E:Proof/TD:Default [2] Vulnerability: Unsupported Module Description: KCFinder is a multi-language file / image manager you can use to easily select, insert, upload and arrange images, flash movies, and other kinds of files. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466 [3]. The security team marks all unsupported modules critical by default. Solution: If you use the KCFinder integration you should uninstall it. Reported By: Neil Drumm [4] of the Drupal Security Team Fixed By: N/A [1] https://www.drupal.org/project/kcfinder [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466 [4] https://www.drupal.org/u/drumm

1 0

Simple Taxonomy Revision - Critical - Unsupported - SA-CONTRIB-2018-025
by security-news＠drupal.org 09 May '18

09 May '18

View online: https://www.drupal.org/sa-contrib-2018-025 Project: Simple Taxonomy Revision [1] Date: 2018-May-09 Security risk: *Critical* 16∕25 AC:None/A:User/CI:Some/II:Some/E:Proof/TD:Default [2] Vulnerability: Unsupported Description: Simple Taxonomy Revision module enables revisions for taxonomy terms for Drupal 8. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466 [3]. The security team marks all unsupported modules critical by default. Solution: If you use the Simple Taxonomy Revision module you should uninstall it. Reported By: Balazs Janos Tatar [4] Fixed By: N/A [1] https://www.drupal.org/project/simple_revision [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466 [4] https://www.drupal.org/user/649590

1 0

Scrollable Content - Critical - Unsupported - SA-CONTRIB-2018-026
by security-news＠drupal.org 09 May '18

09 May '18

View online: https://www.drupal.org/sa-contrib-2018-026 Project: Scrollable Content [1] Date: 2018-May-09 Security risk: *Critical* 16∕25 AC:None/A:User/CI:Some/II:Some/E:Proof/TD:Default [2] Vulnerability: Unsupported Description: Scrollable Content provides a scrolling functionality for your content. Scrollable Content will give you a nice content slider preview of your site's nodes, and provides some display options. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466 [3]. The security team marks all unsupported modules critical by default. Solution: If you use the Scrollable Content module you should uninstall it. Reported By: Balazs Janos Tatar [4] Fixed By: N/A [1] https://www.drupal.org/project/scrollable_content [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466 [4] https://www.drupal.org/user/649590

1 0