Security-news

Download

security-news@drupal.org

January 2020

1 participants
2 discussions

SpamSpan filter - Moderately critical - Cross site scripting - SA-CONTRIB-2020-002
by security-news＠drupal.org 22 Jan '20

22 Jan '20

View online: https://www.drupal.org/sa-contrib-2020-002 Project: SpamSpan filter [1] Date: 2020-January-22 Security risk: *Moderately critical* 11∕25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross site scripting Description: The SpamSpan module obfuscates email addresses to help prevent spambots from collecting them. This module contains a spamspan twig filter which doesn't sanitize the passed HTML string. This vulnerability is mitigated by the fact that sites must have custom twig template files that use the SpamSpan filter on a field that an attacker could populate. By default the SpamSpan module does not use the vulnerable twig filter. Solution: Install the latest version: * If you use the SpamSpan module for Drupal 8.x, upgrade to SpamSpan 8.x-1.1 [3] Also see the SpamSpan filter [4] project page. Reported By: * Jeroen Tubex [5] Fixed By: * Jeroen Tubex [6] * vitalie [7] Coordinated By: * Ben Jeavons [8] of the Drupal Security Team [1] https://www.drupal.org/project/spamspan [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/spamspan/releases/8.x-1.1 [4] https://www.drupal.org/project/spamspan [5] https://www.drupal.org/user/2228934 [6] https://www.drupal.org/user/2228934 [7] https://www.drupal.org/user/175134 [8] https://www.drupal.org/u/coltrane

1 0

Radix - Moderately critical - Cross site scripting - SA-CONTRIB-2020-001
by security-news＠drupal.org 15 Jan '20

15 Jan '20

View online: https://www.drupal.org/sa-contrib-2020-001 Project: Radix [1] Date: 2020-January-15 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Description: Radix is a base theme for Drupal, with Bootstrap 4, Sass, ES6 and BrowserSync built-in. The module doesn't sufficiently filter menu titles when used in a dropdown in the main menu. This vulnerability is mitigated by the fact that an attacker must have permission to edit a menu title used in the main menu. Solution: Install the latest version: * If you use the Radix theme for Drupal 7.x, upgrade to Radix 7.x-3.8 [3] Also see the Radix [4] project page. Reported By: * annagaz [5] Fixed By: * David Snopek [6] of the Drupal Security Team Coordinated By: * David Snopek [7] of the Drupal Security Team [1] https://www.drupal.org/project/radix [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/radix/releases/7.x-3.8 [4] https://www.drupal.org/project/radix [5] https://www.drupal.org/user/2741499 [6] https://www.drupal.org/user/266527 [7] https://www.drupal.org/user/266527

1 0