August 2019 - Security-news - lists.drupal.org

Imagecache External - Critical - Insecure session token management - SA-CONTRIB-2019-065
by security-news＠drupal.org 21 Aug '19

21 Aug '19

View online: https://www.drupal.org/sa-contrib-2019-065 Project: Imagecache External [1] Date: 2019-August-21 Security risk: *Critical* 15∕25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Insecure session token management Description: This module that allows you to store external images on your server and apply your own Image Styles. The module exposes cookies to external sites when making external image requests. This vulnerability is mitigated by using the whitelisted host feature to restrict external image requests from trusted sources. Solution: Install the latest version: * If you use the Imagecache External 8.x-1.0 version, upgrade to Imagecache External 8.x-1.1 version [3] Also see the Imagecache External [4] project page. Reported By: * Jason Want [5] * Heine Deelstra [6] of the Drupal Security Team Fixed By: * Heine Deelstra [7] of the Drupal Security Team * Baris Wanschers [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/imagecache_external [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/imagecache_external/releases/8.x-1.1 [4] https://www.drupal.org/project/imagecache_external [5] https://www.drupal.org/user/589890 [6] https://www.drupal.org/user/17943 [7] https://www.drupal.org/user/17943 [8] https://www.drupal.org/user/107229 [9] https://www.drupal.org/user/36762

1 0

Forms Steps - Critical - Access bypass - SA-CONTRIB-2019-064
by security-news＠drupal.org 14 Aug '19

14 Aug '19

View online: https://www.drupal.org/sa-contrib-2019-064 Project: Forms Steps [1] Date: 2019-August-14 Security risk: *Critical* 16∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: Forms Steps provides an UI to create form workflows using form modes. It creates quick and configurable multisteps forms. The module doesn't sufficiently check user permissions to access its workflows entities that allows to see any entities that have been created through the different steps of its multistep forms. This vulnerability is mitigated by the fact that you have to know the Forms Steps URL to create a content linked to the flow. Also, all created content is very hard to edit through the same flow as you have to know the URL and the linked hash to the content. Solution: Install the latest version: * If you use the Forms Steps module for Drupal 8.x, upgrade to Forms Steps 8.x-1.2 [3] Also see the Forms Steps [4] project page. Reported By: * solide-echt [5] Fixed By: * Hakim Rachidi [6] * solide-echt [7] * nicoloye [8] Coordinated By: * Michael Hess [9] of the Drupal Security Team * Greg Knaddison [10] of the Drupal Security Team [1] https://www.drupal.org/project/forms_steps [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/forms_steps/releases/8.x-1.2 [4] https://www.drupal.org/project/forms_steps [5] https://www.drupal.org/user/46176 [6] https://www.drupal.org/user/3008327 [7] https://www.drupal.org/user/46176 [8] https://www.drupal.org/user/315225 [9] https://www.drupal.org/user/102818 [10] https://www.drupal.org/user/36762

1 0

External Links Filter - Moderately critical - Open Redirect Vulnerability - SA-CONTRIB-2019-063
by security-news＠drupal.org 14 Aug '19

14 Aug '19

View online: https://www.drupal.org/sa-contrib-2019-063 Project: External Links Filter [1] Date: 2019-August-14 Security risk: *Moderately critical* 10∕25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:All [2] Vulnerability: Open Redirect Vulnerability Description: The External Link Filter module provides an input filter that replaces external links by a local link that redirects to the target URL. The module did not have protection for the Redirect URL to go where content authors intended. Solution: Install the latest version: * If you use the External Links Filter module for Drupal 7.x, upgrade to External Links Filter version 7.x-3.1 [3] * If you use the External Links Filter module for Drupal 8.x, upgrade to External Links Filter version 8.x-1.2 [4] Also see the External Links Filter [5] project page. Reported By: * Manuel Adán [6] Fixed By: * Manuel Adán [7] * Dmitry Drozdik [8] Coordinated By: * Michael Hess [9] of the Drupal Security Team * Greg Knaddison [10] of the Drupal Security Team [1] https://www.drupal.org/project/elf [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/elf/releases/7.x-3.1 [4] https://www.drupal.org/project/elf/releases/8.x-1.2 [5] https://www.drupal.org/project/elf [6] https://www.drupal.org/user/516420 [7] https://www.drupal.org/user/516420 [8] https://www.drupal.org/user/574124 [9] https://www.drupal.org/user/102818 [10] https://www.drupal.org/user/36762

1 0

Super Login - Moderately critical - Cross site scripting - SA-CONTRIB-2019-062
by security-news＠drupal.org 14 Aug '19

14 Aug '19

View online: https://www.drupal.org/sa-contrib-2019-062 Project: Super Login [1] Date: 2019-August-14 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Description: This module improves the Drupal login page with the new features and layout. The module doesn't sufficiently filter input text in the administration pages text configuration inputs. For example, the login text field. The vulnerability is mitigated by the fact it can only be exploited by a user with the "Administer super login" permission. Solution: Install the latest version: * If you use the Super Login module for Drupal 8.x, upgrade to Super Login 8.x-1.3 [3] * If you use the Super Login module for Drupal 7.x, upgrade to Super Login 7.x-1.4 [4] Also see the Super Login [5] project page. Reported By: * Mitch Portier [6] Fixed By: * Mitch Portier [7] * Shawn Ostermann [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/super_login [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/super_login/releases/8.x-1.3 [4] https://www.drupal.org/project/super_login/releases/7.x-1.4 [5] https://www.drupal.org/project/super_login [6] https://www.drupal.org/user/2284182 [7] https://www.drupal.org/user/2284182 [8] https://www.drupal.org/user/61221 [9] https://www.drupal.org/user/36762

1 0

scroll to top - Moderately critical - Cross site scripting - SA-CONTRIB-2019-061
by security-news＠drupal.org 14 Aug '19

14 Aug '19

View online: https://www.drupal.org/sa-contrib-2019-061 Project: scroll to top [1] Date: 2019-August-14 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Description: The Scroll To Top module enables you to have an animated scroll to top link in the bottom of the node. The module does not sufficiently filter configuration text leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer scroll to top". Solution: Install the latest version of the module. * If you use the Scroll To Top module for Drupal 7.x, upgrade to Scroll To Top 7.x-2.2 [3] Also see the scroll to top [4] project page. Reported By: * Ayesh Karunaratne [5] * Yonatan Offek [6] Fixed By: * Ayesh Karunaratne [7] * Tarek Djebali [8] Coordinated By: * Michael Hess [9] of the Drupal Security Team * Greg Knaddison [10] of the Drupal Security Team [1] https://www.drupal.org/project/scroll_to_top [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/scroll_to_top/releases/7.x-2.2 [4] https://www.drupal.org/project/scroll_to_top [5] https://www.drupal.org/user/796148 [6] https://www.drupal.org/user/194009 [7] https://www.drupal.org/user/796148 [8] https://www.drupal.org/user/745218 [9] https://www.drupal.org/user/102818 [10] https://www.drupal.org/user/36762

1 0