October 2019 - Security-news - lists.drupal.org

Booking and Availability Management Tools for Drupal - Moderately critical - Access Bypass - SA-CONTRIB-2019-074
by security-news＠drupal.org 16 Oct '19

16 Oct '19

View online: https://www.drupal.org/sa-contrib-2019-074 Project: Booking and Availability Management Tools for Drupal [1] Date: 2019-October-16 Security risk: *Moderately critical* 11∕25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access Bypass Description: The Bat module provides a foundation through which a wide range of availability management, reservation and booking use cases can be addressed. The routes used to view events don't sufficiently guard access for non-privileged users. Specifically, a user with the 'View own' permission for bat events can view others' events as well. Solution: Install the latest version: * If you use the bat module for Drupal 8.x, upgrade to bat 8.x-1.2 [3] Also see the Booking and Availability Management Tools for Drupal [4] project page. Reported By: * Jelle Sebreghts [5] Fixed By: * Adrian Rollett [6] * Lee Rowlands [7] of the Drupal Security Team * Jelle Sebreghts [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/bat [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/bat/releases/8.x-1.2 [4] https://www.drupal.org/project/bat [5] https://www.drupal.org/user/829198 [6] https://www.drupal.org/user/253909 [7] https://www.drupal.org/user/395439 [8] https://www.drupal.org/user/829198 [9] https://www.drupal.org/user/36762

1 0

Maxlength - Moderately critical - Cross Site Scripting - SA-CONTRIB-2019-073
by security-news＠drupal.org 09 Oct '19

09 Oct '19

View online: https://www.drupal.org/sa-contrib-2019-073 Project: Maxlength [1] Date: 2019-October-09 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: This module enables you to set a maximum length allowed on text fields and indicate how many characters are left. The module doesn't sufficiently filter strings leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact the malicious script will not be triggered in the browser of UID 1 nor any user with "Bypass maxlength setting". Solution: Install the latest version: * If you use the Maxlength module for Drupal 7.x, upgrade to Maxlength 7.x-3.3 [3] Also see the Maxlength [4] project page. Reported By: * Yonatan Offek [5] Fixed By: * Yonatan Offek [6] * Aron Novak [7] * Daniel Wehner [8] Coordinated By: * Greg Knaddison [9] Drupal Security Team member [1] https://www.drupal.org/project/maxlength [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/maxlength/releases/7.x-3.3 [4] https://www.drupal.org/project/maxlength [5] https://www.drupal.org/user/194009 [6] https://www.drupal.org/user/194009 [7] https://www.drupal.org/user/61864 [8] https://www.drupal.org/user/99340 [9] https://www.drupal.org/user/36762

1 0

Localization update - Moderately critical - Insecure server configuration - SA-CONTRIB-2019-072
by security-news＠drupal.org 02 Oct '19

02 Oct '19

View online: https://www.drupal.org/sa-contrib-2019-072 Project: Localization update [1] Date: 2019-October-02 Security risk: *Moderately critical* 10∕25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Insecure server configuration Description: This module enables you to automatically download and update the site's interface translation by fetching them from localize.drupal.org or any other Localization server. The module doesn't sufficiently protect the directory it stores translation files in. It's conventional for directories which may be writeable to be protected by a .htaccess file to prevent malicious PHP files placed within them being executed by the webserver. This vulnerability is mitigated by the fact that an attacker typically wouldn't be able to place a malicious file in the module's storage directory. Solution: Install the latest version: * If you use the Localization Update module for Drupal 7.x-1.x, upgrade to Localization Update 7.x-1.2 [3] * If you use the Localization Update module for Drupal 7.x-2.x, upgrade to Localization Update 7.x-2.3 [4] Also see the Localization update [5] project page. Reported By: Gisle Hannemyr [6] Fixed By: * Gisle Hannemyr [7] * Erik Stielstra [8] * Gábor Hojtsy [9] Coordinated By: * Damien McKenna [10] of the Drupal Security Team [1] https://www.drupal.org/project/l10n_update [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/l10n_update/releases/7.x-1.2 [4] https://www.drupal.org/project/l10n_update/releases/7.x-2.3 [5] https://www.drupal.org/project/l10n_update [6] https://www.drupal.org/user/409554 [7] https://www.drupal.org/user/409554 [8] https://www.drupal.org/user/73854 [9] https://www.drupal.org/user/4166 [10] https://www.drupal.org/u/dmckenna

1 0

Simple AMP (Accelerated Mobile Pages) - Moderately critical - Access bypass - SA-CONTRIB-2019-071
by security-news＠drupal.org 02 Oct '19

02 Oct '19

View online: https://www.drupal.org/sa-contrib-2019-071 Project: Simple AMP (Accelerated Mobile Pages) [1] Date: 2019-October-02 Security risk: *Moderately critical* 13∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: This module allows display of a site's content in AMP format. The module doesn't sufficiently check access on unpublished or restricted content. Solution: Install the latest version of the module. * If you use the Simple AMP module for Drupal 8.x, upgrade to Simple AMP 8.x-1.16 [3] Also see the Simple AMP (Accelerated Mobile Pages) [4] project page. Reported By: * M. H. [5] Fixed By: * Minnur Yunusov [6] * M. H. [7] Coordinated By: * Damien McKenna [8] of the Drupal Security Team [1] https://www.drupal.org/project/simple_amp [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/simple_amp/releases/8.x-1.16 [4] https://www.drupal.org/project/simple_amp [5] https://www.drupal.org/user/3054025 [6] https://www.drupal.org/user/702026 [7] https://www.drupal.org/user/3054025 [8] https://www.drupal.org/u/damienmckenna

1 0

Ubercart - Moderately critical - Cross site scripting - SA-CONTRIB-2019-070
by security-news＠drupal.org 02 Oct '19

02 Oct '19

View online: https://www.drupal.org/sa-contrib-2019-070 Project: Ubercart [1] Date: 2019-October-02 Security risk: *Moderately critical* 11∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross site scripting Description: The Ubercart module provides a shopping cart and e-commerce features for Drupal. The order module doesn't sufficiently sanitize user input when displayed on an invoice leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "edit orders". Solution: Install the latest version: * If you use the Ubercart module for Drupal 7.x, upgrade to Ubercart 7.x-3.13 [3] Also see the Ubercart [4] project page. Reported By: * Devin Zuczek [5] Fixed By: * Devin Zuczek [6] * Dave Long [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/ubercart [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ubercart/releases/7.x-3.13 [4] https://www.drupal.org/project/ubercart [5] https://www.drupal.org/user/701754 [6] https://www.drupal.org/user/701754 [7] https://www.drupal.org/user/246492 [8] https://www.drupal.org/user/36762

1 0