June 2021 - Security-news - lists.drupal.org

GraphQL - Moderately critical - Information Disclosure - SA-CONTRIB-2021-013
by security-news＠drupal.org 02 Jun '21

02 Jun '21

View online: https://www.drupal.org/sa-contrib-2021-013 Project: GraphQL [1] Date: 2021-June-02 Security risk: *Moderately critical* 11∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Information Disclosure Description: This module lets you craft and expose a GraphQL web service API. The module does not sufficiently protect arbitrary exception and error messages thereby exposing an information disclosure vulnerability. This vulnerability is mitigated by the fact that a GraphQL server must be enabled and a data producer be configured that throws exceptions with confidential error messages that must not be exposed over the GraphQL API. Solution: Install the latest version: * If you use the GraphQL module for Drupal 8.x, upgrade to GraphQL 8.x-4.1 [3] Reported By: * Alex Tkachev [4] Fixed By: * Klaus Purer [5] * Radoslav Terezka [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team [1] https://www.drupal.org/project/graphql [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/graphql/releases/8.x-4.1 [4] https://www.drupal.org/user/390336 [5] https://www.drupal.org/user/262198 [6] https://www.drupal.org/user/741876 [7] https://www.drupal.org/user/36762

1 0

Frequently Asked Questions - Moderately critical - Cross Site Scripting - SA-CONTRIB-2021-012
by security-news＠drupal.org 02 Jun '21

02 Jun '21

View online: https://www.drupal.org/sa-contrib-2021-012 Project: Frequently Asked Questions [1] Date: 2021-June-02 Security risk: *Moderately critical* 11∕25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: The Frequently Asked Questions (faq) module allows users, with appropriate permissions, to create question and answer pairs which they want displayed on the 'faq' page. The 'faq' page is automatically generated from the FAQ nodes configured. Basic Views layouts are also provided and can be customised via the Views UI (rather than via the module settings page). The module doesn't sufficiently sanitize editor input leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the "create faq content" permission. Solution: Install the latest version: * If you use the Frequently Asked Questions module for Drupal 7.x, upgrade to Frequently Asked Questions 7.x-1.3 [3] Reported By: * Mitch Portier [4] Fixed By: * Mitch Portier [5] * Mohammed Razem [6] * Vijay Mani [7] Provisional Member of the Drupal Security Team Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/faq [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/faq/releases/7.x-1.3 [4] https://www.drupal.org/user/2284182 [5] https://www.drupal.org/user/2284182 [6] https://www.drupal.org/user/255384 [7] https://www.drupal.org/user/93488 [8] https://www.drupal.org/user/36762

1 0

Open Social - Critical - Authentication Bypass - SA-CONTRIB-2021-011
by security-news＠drupal.org 02 Jun '21

02 Jun '21

View online: https://www.drupal.org/sa-contrib-2021-011 Project: Open Social [1] Date: 2021-June-02 Security risk: *Critical* 15∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Authentication Bypass Description: Open Social is a Drupal distribution for online communities. The included social_magic_login module doesn't sufficiently validate magic login URLs for user accounts. The lack of validation makes it possible for an adversary to forge valid login URLs and login to such an account. This vulnerability is mitigated by the fact the module social_magic_login needs to be enabled. Solution: Install the latest version of Open Social: * If you use the Open Social distribution for Drupal 10.0.x, upgrade to Open Social 10.0.13 [3] * If you use the Open Social distribution for Drupal 10.1.x, upgrade to Open social 10.1.6 [4] Alternatively, disable the module social_magic_login. Reported By: * Ronald te Brake [5] * Alexander Varwijk [6] * Robert Ragas [7] Fixed By: * Ronald te Brake [8] * Alexander Varwijk [9] * Robert Ragas [10] Coordinated By: * Greg Knaddison [11] of the Drupal Security Team [1] https://www.drupal.org/project/social [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/social/releases/10.0.13 [4] https://www.drupal.org/project/social/releases/10.1.6 [5] https://www.drupal.org/user/2314038 [6] https://www.drupal.org/user/1868952 [7] https://www.drupal.org/user/2723261 [8] https://www.drupal.org/user/2314038 [9] https://www.drupal.org/user/1868952 [10] https://www.drupal.org/user/2723261 [11] https://www.drupal.org/user/36762

1 0

Open Social - Moderately critical - SQL Injection - SA-CONTRIB-2021-010
by security-news＠drupal.org 02 Jun '21

02 Jun '21

View online: https://www.drupal.org/sa-contrib-2021-010 Project: Open Social [1] Date: 2021-June-02 Security risk: *Moderately critical* 11∕25 AC:Complex/A:User/CI:All/II:None/E:Theoretical/TD:Default [2] Vulnerability: SQL Injection Description: This Open Social distribution provides a turn-key system for building customized social networks. The module doesn't sufficiently process data in certain circumstances. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access mentions". Solution: Install the latest version: * If you use Open Social 9.x, upgrade to 8.x-9.17 [3] * If you use Open Social 10.0.x, upgrade to 10.0.13 [4] * If you use Open Social 10.1.x, upgrade to 10.1.6 [5] Reported By: * mindaugasd [6] Fixed By: * mindaugasd [7] * Alexander Varwijk [8] * Drew Webber [9] of the Drupal Security Team * Ronald te Brake [10] * Neil Drumm [11] of the Drupal Security Team Coordinated By: * Greg Knaddison [12] of the Drupal Security Team [1] https://www.drupal.org/project/social [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/social/releases/8.x-9.17 [4] https://www.drupal.org/project/social/releases/10.0.13 [5] https://www.drupal.org/project/social/releases/10.1.6 [6] https://www.drupal.org/user/330097 [7] https://www.drupal.org/user/330097 [8] https://www.drupal.org/user/1868952 [9] https://www.drupal.org/user/255969 [10] https://www.drupal.org/user/2314038 [11] https://www.drupal.org/user/3064 [12] https://www.drupal.org/user/36762

1 0