July 2019 - Security-news - lists.drupal.org

Existing Values Autocomplete Widget - Critical - Access bypass - SA-CONTRIB-2019-060
by security-news＠drupal.org 24 Jul '19

24 Jul '19

View online: https://www.drupal.org/sa-contrib-2019-060 Project: Existing Values Autocomplete Widget [1] Date: 2019-July-24 Security risk: *Critical* 17∕25 AC:None/A:None/CI:All/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: This module provides an autocomplete widget for text fields that suggests all existing (previously entered) values for that field. The module doesn't sufficiently check for proper access permission before returning autocomplete results. This vulnerability is mitigated by the fact that an attacker must know the route to the autocomplete callback controller though this is easily known. Solution: Install the latest version: * If you use the Existing Values Autocomplete Widget module for Drupal 8.x, upgrade to Existing Values Autocomplete Widget 8.x-1.2 [3] Also see the Existing Values Autocomplete Widget [4] project page. Reported By: * David Stinemetze [5] Fixed By: * Art Williams [6] Coordinated By: * Michael Hess [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/existing_values_autocomplete_widget [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/3069768 [4] https://www.drupal.org/project/existing_values_autocomplete_widget [5] https://www.drupal.org/user/2508346 [6] https://www.drupal.org/user/77599 [7] https://www.drupal.org/user/102818 [8] https://www.drupal.org/user/36762

1 0

Facebook Messenger Customer Chat Plugin - Critical - Access bypass - SA-CONTRIB-2019-059
by security-news＠drupal.org 24 Jul '19

24 Jul '19

View online: https://www.drupal.org/sa-contrib-2019-059 Project: Facebook Messenger Customer Chat Plugin [1] Date: 2019-July-24 Security risk: *Critical* 16∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: The Facebook Messenger Customer Chat Plugin module enables you to add the Facebook Messenger Customer Chat Plugin to your Drupal site. The module doesn't require user permissions on the admin page. Solution: Install the latest version: * If you use the Facebook Messenger Customer Chat Plugin module for Drupal 7.x, upgrade to Facebook Messenger Customer Chat Plugin 7.x-1.1 [3] Also see the Facebook Messenger Customer Chat Plugin [4] project page. Reported By: -------- REPORTED BY --------------------------------------------------------- * Marcelo Vani [5] Fixed By: * Marcelo Vani [6] Coordinated By: * Michael Hess [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/fb_messenger_customer_chat_plugin [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/fb_messenger_customer_chat_plugin/releases/7… [4] https://www.drupal.org/project/fb_messenger_customer_chat_plugin [5] https://www.drupal.org/user/854220 [6] https://www.drupal.org/user/854220 [7] https://www.drupal.org/user/102818 [8] https://www.drupal.org/user/36762

1 0

Metatag - Moderately critical - Information disclosure - SA-CONTRIB-2019-058
by security-news＠drupal.org 24 Jul '19

24 Jul '19

View online: https://www.drupal.org/sa-contrib-2019-058 Project: Metatag [1] Date: 2019-July-24 Security risk: *Moderately critical* 13∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Information disclosure Description: This module enables you to customize meta tags to help with a site's search engine ranking and improve the display of page summaries when shared on social networks. The module doesn't sufficiently check for a site being in maintenance mode. This vulnerability is mitigated by the fact that the site must be configured to disallow access to certain content, and must be put into maintenance mode. Solution: Install the latest version: * If you use the Metatag module for Drupal 8.x, upgrade to Metatag 8.x-1.9 [3] Also see the Metatag [4] project page. Reported By: * Shloma [5] Fixed By: * Damien McKenna [6] of the Drupal Security Team Coordinated By: * Damien McKenna [7] of the Drupal Security Team [1] https://www.drupal.org/project/metatag [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/metatag/releases/8.x-1.9 [4] https://www.drupal.org/project/metatag [5] https://www.drupal.org/user/2858019 [6] https://www.drupal.org/user/108450 [7] https://www.drupal.org/u/damienmckenna

1 0

Drupal core - Critical - Access bypass - SA-CORE-2019-008
by security-news＠drupal.org 17 Jul '19

17 Jul '19

View online: https://www.drupal.org/sa-core-2019-008 Project: Drupal core [1] Date: 2019-July-17 Security risk: *Critical* 17∕25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass CVE IDs: CVE-2019-6342 Description: In Drupal 8.7.4, when the experimental [3] Workspaces module is enabled, an access bypass condition is created. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4. Drupal 8.7.3 and earlier, Drupal 8.6.x and earlier, and Drupal 7.x are *not* affected. Solution: If the site is running Drupal 8.7.4, upgrade to Drupal 8.7.5. *Note, manual step needed.* For sites with the Workspaces module enabled, update.php needs to run to ensure a required cache clear. If there is a reverse proxy cache or content delivery network (e.g. Varnish, CloudFlare) it is also advisable to clear these as well. Reported By: * Dave Botsch [4] Fixed By: * Michael Hess [5] of the Drupal Security Team * Jess [6] of the Drupal Security Team * Greg Knaddison [7] of the Drupal Security Team * Chris McCafferty [8] of the Drupal Security Team * Neil Drumm [9] of the Drupal Security Team * Alex Pott [10] of the Drupal Security Team * Andrei Mateescu [11] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/core/experimental#beta [4] https://www.drupal.org/user/3534164 [5] https://www.drupal.org/user/102818 [6] https://www.drupal.org/user/65776 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/1850070 [9] https://www.drupal.org/user/3064 [10] https://www.drupal.org/user/157725 [11] https://www.drupal.org/user/729614

1 0

ImageCache Actions - Critical - Multiple Vulnerabilities - SA-CONTRIB-2019-056
by security-news＠drupal.org 17 Jul '19

17 Jul '19

View online: https://www.drupal.org/sa-contrib-2019-056 Project: ImageCache Actions [1] Date: 2019-July-17 Security risk: *Critical* 17∕25 AC:Basic/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Multiple Vulnerabilities Description: The imagecache actions module defines a number of additional image effects that can be used to create image styles. The "Image styles admin" sub module provides additional functionality to duplicate, export and import image styles. The module uses unserialize() to import image styles into another site where unserialize() is known to have security issues when processing potentially unsafe input. This vulnerability is mitigated by the fact that the "Image styles admin" sub module must be enabled and an attacker must have a role with the permission "'administer image styles'". Furthermore, the import functionality supports PHP code included in image effects as part of an image style, which would run on image derivative generation subject to the PHP module being enabled. This is intended behaviour for the "Image styles admin" sub module, but the user access restrictions should reflect the potential risks involved. The new security release of this module introduces a new "import image styles" permission which is marked as restricted. In order to use the image style import functionality, users will need to have a role which has this new permission in addition to "administer image styles" (which is not marked as restricted). Solution: * If you use the Imagecache Actions module for Drupal 7.x, upgrade to Imagecache Actions 7.x-1.10 [3]. * Image Effects [4], the D8 successor is *not* vulnerable to this exploit. Reported By: * Ruben Hofman [5] Fixed By: * Erwin Derksen [6] * Greg Knaddison [7] of the Drupal Security Team Coordinated By: * Greg Knaddison [8] of the Drupal Security Team * Ivo Van Geertruyen [9] of the Drupal Security Team * Drew Webber [10] of the Drupal Security Team [1] https://www.drupal.org/project/imagecache_actions [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/imagecache_actions/releases/7.x-1.10 [4] https://www.drupal.org/project/image_effects [5] https://www.drupal.org/user/3302721 [6] https://www.drupal.org/user/750928 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/36762 [9] https://www.drupal.org/user/383424 [10] https://www.drupal.org/user/255969

1 0

Meta tags quick - Moderately critical - Cross Site Scripting - SA-CONTRIB-2019-057
by security-news＠drupal.org 17 Jul '19

17 Jul '19

View online: https://www.drupal.org/sa-contrib-2019-057 Project: Meta tags quick [1] Date: 2019-July-17 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: Metatags quick is a module that manages meta tags (tags that appear in HTML's head section) as Drupal 7 fields. Administration page of metatags quick does not sanitize the output of blocks that appear on the same page. This allows an attacker to inject malicious JavaScript in block markup. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer blocks". Solution: Install the latest version. If you use the Metatags quick module for Drupal 7.x, upgrade to metatags quick 7.x-2.10. [3] Reported By: * Yonatan Offek [4] Fixed By: * Valery Lourie [5] * Yonatan Offek [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team [1] https://www.drupal.org/project/metatags_quick [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/metatags_quick/releases/7.x-2.10 [4] https://www.drupal.org/user/194009 [5] https://www.drupal.org/user/239562 [6] https://www.drupal.org/user/194009 [7] https://www.drupal.org/user/36762

1 0

Custom Permissions - Critical - Access bypass - SA-CONTRIB-2019-055
by security-news＠drupal.org 10 Jul '19

10 Jul '19

View online: https://www.drupal.org/sa-contrib-2019-055 Project: Custom Permissions [1] Version: 8.x-1.x-dev Date: 2019-July-10 Security risk: *Critical* 16∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: This module enables you to add and manage additional custom permissions through the administration UI. The module doesn't sufficiently check for the proper access permissions to this page. This vulnerability is mitigated by the fact that an attacker must know the route of the Custom Permissions administration form though this is easily known. Solution: Install the latest version: * If you use the Custom Permissions 8.x-1.1 for Drupal 8.x, upgrade to Custom Permissions 8.x-1.2 [3] Also see the Custom Permissions [4] project page. Reported By: * Mohammed Razem [5] Fixed By: * David Valdez [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team [1] https://www.drupal.org/project/config_perms [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/config_perms/releases/8.x-1.2 [4] https://www.drupal.org/project/config_perms [5] https://www.drupal.org/user/255384 [6] https://www.drupal.org/user/992990 [7] https://www.drupal.org/user/36762

1 0