May 2020 - Security-news - lists.drupal.org

Password Reset Landing Page (PRLP) - Highly critical - Access bypass - SA-CONTRIB-2020-021
by security-news＠drupal.org 27 May '20

27 May '20

View online: https://www.drupal.org/sa-contrib-2020-021 Project: Password Reset Landing Page (PRLP) [1] Date: 2020-May-27 Security risk: *Highly critical* 20∕25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: This module enables you to force a password update when using password reset link. The module doesn't sufficiently validate the login URL allowing a malicious user to use a specially crafted URL to log in as another user. Solution: Install the latest version: * If you use the PRLP module for Drupal 8.x, upgrade to PRLP 8.x-1.5 [3] Also see the Password Reset Landing Page (PRLP) [4] project page. Reported By: * Kyle Einecker [5] * Seth Hill [6] Fixed By: * Joseph Purcell [7] * Jitesh Doshi [8] * Christian Crawford [9] * Kyle Einecker [10] Coordinated By: * Greg Knaddison [11] of the Drupal Security Team [1] https://www.drupal.org/project/prlp [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/prlp/releases/8.x-1.5 [4] https://www.drupal.org/project/prlp [5] https://www.drupal.org/user/2824963 [6] https://www.drupal.org/user/676480 [7] https://www.drupal.org/user/2944035 [8] https://www.drupal.org/user/1799550 [9] https://www.drupal.org/user/2888131 [10] https://www.drupal.org/user/2824963 [11] https://www.drupal.org/user/36762

1 0

Drupal Commerce - Moderately critical - Access bypass - SA-CONTRIB-2020-020
by security-news＠drupal.org 27 May '20

27 May '20

View online: https://www.drupal.org/sa-contrib-2020-020 Project: Drupal Commerce [1] Date: 2020-May-27 Security risk: *Moderately critical* 12∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Description: Drupal Commerce is used to build eCommerce websites and applications. It's possible to configure commerce to permit orders by anonymous users. In this configuration, customers who do not choose to create an account upon checkout completion remain anonymous, and the resulting orders are never assigned an owner. When anonymous users are granted the "View own orders" permission, they are able to see any such anonymous order via direct navigation to its view page. The module does not include extra access control necessary to ensure anonymous users are only able to view their own previously placed orders. This vulnerability is mitigated by the fact that a site must be configured to permit anonymous checkout and an attacker must be an anonymous user with the permission "View own orders". Solution: Install the latest version: * If you use Commerce for Drupal 8.x upgrade to Commerce 2.18 [3] Also see the Drupal Commerce [4] project page. Reported By: * Joe Kersey [5] * Honza Pobořil [6] Fixed By: * Alex Pott [7] of the Drupal Security Team * Matt Glaman [8] * Joe Kersey [9] Coordinated By: * Greg Knaddison [10] of the Drupal Security Team [1] https://www.drupal.org/project/commerce [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/commerce/releases/8.x-2.18 [4] https://www.drupal.org/project/commerce [5] https://www.drupal.org/user/2229066 [6] https://www.drupal.org/user/123612 [7] https://www.drupal.org/user/157725 [8] https://www.drupal.org/user/2416470 [9] https://www.drupal.org/user/2229066 [10] https://www.drupal.org/user/36762

1 0

Drupal core - Moderately critical - Open Redirect - SA-CORE-2020-003
by security-news＠drupal.org 20 May '20

20 May '20

View online: https://www.drupal.org/sa-core-2020-003 Project: Drupal core [1] Date: 2020-May-20 Security risk: *Moderately critical* 10∕25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:All [2] Vulnerability: Open Redirect Description: Drupal 7 has an Open Redirect vulnerability. For example, a user could be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL. The vulnerability is caused by insufficient validation of the destination query parameter in the drupal_goto() function. Other versions of Drupal core are not vulnerable. Solution: Install the latest version: * If you use Drupal 7.x upgrade to Drupal 7.70 [3] Reported By: * vortfu [4] Fixed By: * Drew Webber [5] of the Drupal Security Team * Fabian Franz [6] * David Snopek [7] of the Drupal Security Team * vortfu [8] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/drupal/releases/7.70 [4] https://www.drupal.org/user/3638636 [5] https://www.drupal.org/user/255969 [6] https://www.drupal.org/user/693738 [7] https://www.drupal.org/user/266527 [8] https://www.drupal.org/user/3638636

1 0

Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2020-002
by security-news＠drupal.org 20 May '20

20 May '20

View online: https://www.drupal.org/sa-core-2020-002 Project: Drupal core [1] Date: 2020-May-20 Security risk: *Moderately critical* 10∕25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross Site Scripting Description: The jQuery project released version 3.5.0, and as part of that, disclosed two security vulnerabilities that affect all prior versions. As mentioned in the jQuery blog [3], both are >[...] security issues in jQuery’s DOM manipulation methods, as in .html(), >.append(), and the others. Security advisories for both of these issues have >been published on GitHub. > Those advisories are: * CVE-2020-11022 [4] * CVE-2020-11023 [5] These vulnerabilities may be exploitable on some Drupal sites. This Drupal security release backports the fixes to the relevant jQuery functions, without making any other changes to the jQuery version that is included in Drupal core or running on the site via some other module such as jQuery Update [6]. It is not necessary to update jquery_update on Drupal 7 sites that have the module installed. Backwards-compatibility code has also been added to minimize regressions to Drupal sites that might rely on jQuery's prior behavior. With jQuery 3.5, incorrect self-closing HTML tags in JavaScript for elements where end tags are normally required will encounter a change in what jQuery returns or inserts [7]. To minimize that disruption in 8.8.x and earlier, this security release retains jQuery's prior behavior for most safe tags. There may still be regressions for edge cases, including invalidly self-closed custom elements [8] on Internet Explorer. (Note: the backwards compatibility layer will not be included in the upcoming Drupal 8.9 and 9.0 releases, so Drupal 8 and 9 modules, themes, and sites should correct tags in JavaScript to properly use closing tags.) If you find a regression [9] caused by the jQuery changes, please report it in Drupal core's issue queue [10] (or that of the relevant contrib project). However, if you believe you have found a security issue, please report it privately to the Drupal Security Team [11]. Solution: Install the latest version: * If you are using Drupal 8.8, upgrade to Drupal 8.8.6 [12]. * If you are using Drupal 8.7, upgrade to Drupal 8.7.14 [13]. * If you are using Drupal 7, upgrade to Drupal 7.70 [14]. Versions of Drupal 8 prior to 8.7 are end-of-life and do not receive security coverage. Sites on 8.6 or earlier should update to 8.7.14. The pre-release Drupal versions (8.9 and 9.0) have been updated jQuery to version 3.5.1 as of 8.9.0-beta3 and 9.0.0-beta3. Reported By: * Drew Webber [15] of the Drupal Security Team * Emerson Jair Reis Oliveira da Silva [16] Fixed By: * Drew Webber [17] of the Drupal Security Team * Sally Young [18] * cilefen [19] of the Drupal Security Team * Jess [20] of the Drupal Security Team * Emerson Jair Reis Oliveira da Silva [21] * Lee Rowlands [22] of the Drupal Security Team * Alex Bronstein [23] of the Drupal Security Team * Ben Mullins [24] * Lauri Eskola [25] * Peter Weber [26] * Samuel Mortenson [27] of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://blog.jquery.com/2020/05/04/jquery-3-5-1-released-fixing-a-regressio… [4] https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2 [5] https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6 [6] https://www.drupal.org/project/jquery_update [7] https://jquery.com/upgrade-guide/3.5/#description-of-the-change [8] https://html.spec.whatwg.org/multipage/custom-elements.html [9] https://en.wikipedia.org/wiki/Software_regression [10] https://www.drupal.org/project/issues/drupal [11] https://www.drupal.org/security-team/report-issue [12] https://www.drupal.org/project/drupal/releases/8.8.6 [13] https://www.drupal.org/project/drupal/releases/8.7.14 [14] https://www.drupal.org/project/drupal/releases/7.70 [15] https://www.drupal.org/user/255969 [16] https://www.drupal.org/user/3580914 [17] https://www.drupal.org/user/255969 [18] https://www.drupal.org/user/161058 [19] https://www.drupal.org/user/1850070 [20] https://www.drupal.org/user/65776 [21] https://www.drupal.org/user/3580914 [22] https://www.drupal.org/user/395439 [23] https://www.drupal.org/user/78040 [24] https://www.drupal.org/user/2369194 [25] https://www.drupal.org/user/1078742 [26] https://www.drupal.org/user/1448368 [27] https://www.drupal.org/user/2582268

1 0

reCAPTCHA v3 - Critical - Access bypass - SA-CONTRIB-2020-019
by security-news＠drupal.org 13 May '20

13 May '20

View online: https://www.drupal.org/sa-contrib-2020-019 Project: reCAPTCHA v3 [1] Date: 2020-May-13 Security risk: *Critical* 18∕25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: The reCaptcha v3 module enables you to protect your forms using the Google reCaptcha V3. If the reCaptcha v3 challenge succeeds, all the other form validations are bypassed. This makes it possible for attackers to submit invalid or incomplete forms. This vulnerability only affects forms that are protected by reCaptcha v3 and have server side validation steps (e.g required field or custom validation functions). Solution: Install the latest version: * If you use the reCAPTCHA v3 module for Drupal 8.x, upgrade to reCAPTCHA v3 8.x-1.2 [3] Also see the reCAPTCHA v3 [4] project page. Reported By: * arnaudvz [5] * Martijn Vermeulen [6] Fixed By: * Denis V***** [7] * Majid Ali Khan [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/recaptcha_v3 [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/recaptcha_v3/releases/8.x-1.2 [4] https://www.drupal.org/project/recaptcha_v3 [5] https://www.drupal.org/user/3628871 [6] https://www.drupal.org/user/960720 [7] https://www.drupal.org/user/896504 [8] https://www.drupal.org/user/1271330 [9] https://www.drupal.org/user/36762

1 0

Webform - Critical - Access bypass - SA-CONTRIB-2020-018
by security-news＠drupal.org 13 May '20

13 May '20

View online: https://www.drupal.org/sa-contrib-2020-018 Project: Webform [1] Date: 2020-May-13 Security risk: *Critical* 15∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: This webform module enables you to build a 'Term checkboxes' element. The module doesn't sufficiently check term 'view' access when rendering 'Term checkboxes' elements. Unpublished terms will always appear in the 'Term checkboxes' element. Solution: Install the latest version: * If you use the Webform module for Drupal 8.x, upgrade to Webform 8.x-5.12 [3] Also see the Webform [4] project page. Reported By: * Joseph Zhao [5] Fixed By: * Joseph Zhao [6] * Lee Rowlands [7] of the Drupal Security Team * Jacob Rockowitz [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/8.x-5.12 [4] https://www.drupal.org/project/webform [5] https://www.drupal.org/user/1987218 [6] https://www.drupal.org/user/1987218 [7] https://www.drupal.org/user/395439 [8] https://www.drupal.org/user/371407 [9] https://www.drupal.org/user/36762

1 0

Webform - Moderately critical - Access bypass - SA-CONTRIB-2020-017
by security-news＠drupal.org 06 May '20

06 May '20

View online: https://www.drupal.org/sa-contrib-2020-017 Project: Webform [1] Date: 2020-May-06 Security risk: *Moderately critical* 11∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Description: This module enables you to build forms and surveys in Drupal. The Webform Node sub-module allows these forms to be associated with a Drupal node. The Webform Node module does not implement access checking in the same manner as other nodes and entities. As such, writers of custom modules which implement webform_node, node, or entity access checks may not achieve the intended access results for Webform Node content. There is no known exploit of this vulnerability and the vulnerability only exists on sites with custom code and a node access module in use. Solution: Install the latest version: * If you use the Webform module for Drupal 8, upgrade to Webform 8.x-5.11 [3] Also see the Webform [4] project page. Reported By: * Dan Chadwick [5] Fixed By: * Dan Chadwick [6] * Jacob Rockowitz [7] * Liam Morland [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/8.x-5.11 [4] https://www.drupal.org/project/webform [5] https://www.drupal.org/user/504278 [6] https://www.drupal.org/user/504278 [7] https://www.drupal.org/user/371407 [8] https://www.drupal.org/user/493050 [9] https://www.drupal.org/user/36762

1 0

Webform - Critical - Access bypass - SA-CONTRIB-2020-016
by security-news＠drupal.org 06 May '20

06 May '20

View online: https://www.drupal.org/sa-contrib-2020-016 Project: Webform [1] Date: 2020-May-06 Security risk: *Critical* 15∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: This webform module enables you to build 'Term select' and 'Term checkboxes' elements. The module doesn't sufficiently check term 'view' access when rendering the 'Term select' and 'Term checkboxes' elements. Unpublished terms will always appear in the 'Term select' and 'Term checkboxes' elements. Solution: Install the latest version: * If you use the Webform module for Drupal 8, upgrade to Webform 8.x-5.11 [3] Also see the Webform [4] project page. Reported By: * James Gilliland [5] of the Drupal Security Team Fixed By: * Jacob Rockowitz [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/8.x-5.11 [4] https://www.drupal.org/project/webform [5] https://www.drupal.org/user/48673 [6] https://www.drupal.org/user/371407 [7] https://www.drupal.org/user/36762

1 0

Webform - Moderately critical - Cross site scripting - SA-CONTRIB-2020-015
by security-news＠drupal.org 06 May '20

06 May '20

View online: https://www.drupal.org/sa-contrib-2020-015 Project: Webform [1] Date: 2020-May-06 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Description: This module enables you to build forms and surveys in Drupal. The module doesn't sufficiently sanitize Webform labels nor visibility conditions under the scenario of placing a block. When a webform block is placed and visible on a website any JavaScript code contained within the webform's label was executed. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Edit own webform" (or "Edit any webform"). Solution: Install the latest version: * If you use the Webform module for Drupal 8, upgrade to Webform 8.x-5.11 [3] Also see the Webform [4] project page. Reported By: * Ide Braakman [5] Fixed By: * bucefal91 [6] * Jacob Rockowitz [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/8.x-5.11 [4] https://www.drupal.org/project/webform [5] https://www.drupal.org/user/1879760 [6] https://www.drupal.org/user/504128 [7] https://www.drupal.org/user/371407 [8] https://www.drupal.org/user/36762

1 0

Webform - Moderately critical - Cross site scripting - SA-CONTRIB-2020-014
by security-news＠drupal.org 06 May '20

06 May '20

View online: https://www.drupal.org/sa-contrib-2020-014 Project: Webform [1] Date: 2020-May-06 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Description: This module enables you to build forms and surveys in Drupal. The module doesn't sufficiently filter user input under in the scenario when a webform is edited, namely the message related to character min/max counter does not undergo sufficient filtering and thus allows execution of JavaScript code through it. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Edit own webform" (or "Edit any webform"). Solution: Install the latest version: * If you use the Webform module for Drupal 8, upgrade to Webform 8.x-5.11 [3] Also see the Webform [4] project page. Reported By: * Krzysztof Domański [5] Fixed By: * Krzysztof Domański [6] * Lee Rowlands [7] of the Drupal Security Team * Jacob Rockowitz [8] * bucefal91 [9] Coordinated By: * Greg Knaddison [10] of the Drupal Security Team [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/8.x-5.11 [4] https://www.drupal.org/project/webform [5] https://www.drupal.org/user/3572982 [6] https://www.drupal.org/user/3572982 [7] https://www.drupal.org/user/395439 [8] https://www.drupal.org/user/371407 [9] https://www.drupal.org/user/504128 [10] https://www.drupal.org/user/36762

1 0