September 2021 - Security-news

Linkit - Moderately critical - Cross Site Scripting - SA-CONTRIB-2021-042
by security-news＠drupal.org 29 Sep '21

29 Sep '21

View online: https://www.drupal.org/sa-contrib-2021-042 Project: Linkit [1] Date: 2021-September-29 Security risk: *Moderately critical* 12∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Scripting Description: Linkit provides an easy interface for internal and external linking with WYSIWYG editors by using an autocomplete field. It does not sufficiently sanitize user input. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create or edit an entity bundle. Solution: Install the latest version: * If you use the Linkit module for Drupal 8.x, upgrade to Linkit 8.x-4.4 [3] Reported By: * Patrick Fey [4] Fixed By: * Emil Stjerneman [5] * Patrick Fey [6] * John [7] Coordinated By: * Damien McKenna [8] of the Drupal Security Team * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/linkit [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/linkit/releases/8.x-4.4 [4] https://www.drupal.org/user/998680 [5] https://www.drupal.org/user/464598 [6] https://www.drupal.org/user/998680 [7] https://www.drupal.org/user/3331569 [8] https://www.drupal.org/user/108450 [9] https://www.drupal.org/user/36762

1 0

SAML SP 2.0 Single Sign On (SSO) - SAML Service Provider - Moderately critical - Multiple vulnerabilities - SA-CONTRIB-2021-036
by security-news＠drupal.org 22 Sep '21

22 Sep '21

View online: https://www.drupal.org/sa-contrib-2021-036 Project: SAML SP 2.0 Single Sign On (SSO) - SAML Service Provider [1] Date: 2021-September-22 Security risk: *Moderately critical* 14∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Multiple vulnerabilities Description: This module provides a solution to authenticate visitors using existing SAML providers. Certain non-default configurations allow a malicious user to login as any chosen user. The vulnerability is mitigated by the module's default settings which require the options "Either sign SAML assertions" and "x509 certificate". Solution: Ensure that the "Either SAML response or SAML assertion must be signed" and "x509 certificate" options on the dedicated plugin page are both enabled. Install the latest version: * If you use the SAML SP 2.0 Single Sign On (SSO) - SAML Service Provider module for Drupal 8.x or 9.x, upgrade to SAML SP 2.0 Single Sign On (SSO) - SAML Service Provider 8.x-2.24 [3] * If you use the SAML SP 2.0 Single Sign On (SSO) - SAML Service Provider module for Drupal 7.x, upgrade to SAML SP 2.0 Single Sign On (SSO) - SAML Service Provider 7.x-2.57 [4] Reported By: * Cristian 'void' Giustini [5] Fixed By: * Cristian 'void' Giustini [6] * abhay19 [7] Coordinated By: * Damien McKenna [8] of the Drupal Security Team [1] https://www.drupal.org/project/miniorange_saml [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/miniorange_saml/releases/8.x-2.24 [4] https://www.drupal.org/project/miniorange_saml/releases/7.x-2.60 [5] https://www.drupal.org/user/3680969 [6] https://www.drupal.org/user/3680969 [7] https://www.drupal.org/user/3549350 [8] https://www.drupal.org/u/damienmckenna

1 0

Domain Group - Critical - Access bypass - SA-CONTRIB-2021-037
by security-news＠drupal.org 22 Sep '21

22 Sep '21

View online: https://www.drupal.org/sa-contrib-2021-037 Project: Domain Group [1] Date: 2021-September-22 Security risk: *Critical* 18∕25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: This module enables sites to define a domain from Domain Access that points directly to a group page. The module doesn't sufficiently manage the access to content administrative paths allowing an attacker to see and take actions on content (nodes) they should be allowed to. Solution: Install the latest version: * If you use the domain_group module for Drupal 8.x, upgrade to domain_group 8.x-1.04 [3] * If you use the domain_group module for Drupal 9.x, upgrade to domain_group 2.0.1 [4] Reported By: * Kalle Kipinä [5] Fixed By: * Ivan Duarte [6] * Kalle Kipinä [7] Coordinated By: * Damien McKenna [8] of the Drupal Security Team [1] https://www.drupal.org/project/domain_group [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/domain_group/releases/8.x-1.04 [4] https://www.drupal.org/project/domain_group/releases/2.0.1 [5] https://www.drupal.org/user/813328 [6] https://www.drupal.org/user/1769194 [7] https://www.drupal.org/user/813328 [8] https://www.drupal.org/u/damienmckenna

1 0

The Better Mega Menu - Moderately critical - Cross Site Scripting, Information Disclosure, Multiple vulnerabilities - SA-CONTRIB-2021-038
by security-news＠drupal.org 22 Sep '21

22 Sep '21

View online: https://www.drupal.org/sa-contrib-2021-038 Project: The Better Mega Menu [1] Date: 2021-September-22 Security risk: *Moderately critical* 12∕25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting, Information Disclosure, Multiple vulnerabilities Description: This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content. The module does not sanitize values for CSS properties that are added by admins and rendered on the front-end, allowing attackers to inject malicious code into the front-end markup. This vulnerability is mitigated by the fact that it can only be exploited by an attacker with permissions to administer TB Mega Menu, or a sophisticated anonymous user using a site-specific attack that exploits the Cross Site Request Forgery vulnerability that is fixed by this same release. Solution: Install the latest version: * If you use the TB Mega Menu module for Drupal 8.x, upgrade to TB MegaMenu 8.x-1.4 [3] Reported By: * Patrick Fey [4] Fixed By: * Patrick Fey [5] * knaffles [6] Coordinated By: * Damien McKenna [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/tb_megamenu [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/tb_megamenu/releases/8.x-1.4 [4] https://www.drupal.org/user/998680 [5] https://www.drupal.org/user/998680 [6] https://www.drupal.org/user/1140512 [7] https://www.drupal.org/u/damienmckenna [8] https://www.drupal.org/u/greggles

1 0

The Better Mega Menu - Moderately critical - Cross Site Scripting - SA-CONTRIB-2021-039
by security-news＠drupal.org 22 Sep '21

22 Sep '21

View online: https://www.drupal.org/sa-contrib-2021-039 Project: The Better Mega Menu [1] Date: 2021-September-22 Security risk: *Moderately critical* 13∕25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content. It does not sufficiently sanitize user input such that an admin with permissions to edit a menu may be able to exploit one or more Cross-Site-Scripting (XSS) vulnerabilities. This vulnerability is mitigated by the fact that an attacker must have permission to administer mega menus and/or create or edit menu links, to inject the XSS. Solution: Install the latest version: * If you use the TB Mega Menu module for Drupal 8.x, upgrade to TB MegaMenu 8.x-1.4 [3] Reported By: * Patrick Fey [4] Fixed By: * Patrick Fey [5] * Wade Stewart [6] * Greg Knaddison [7] of the Drupal Security Team * Chris Panza [8] * knaffles [9] Coordinated By: * Damien McKenna [10] of the Drupal Security Team * Greg Knaddison [11] of the Drupal Security Team [1] https://www.drupal.org/project/tb_megamenu [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/tb_megamenu/releases/8.x-1.4 [4] https://www.drupal.org/user/998680 [5] https://www.drupal.org/user/998680 [6] https://www.drupal.org/user/3190381 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/1215854 [9] https://www.drupal.org/user/1140512 [10] https://www.drupal.org/u/damienmckenna [11] https://www.drupal.org/u/greggles

1 0

The Better Mega Menu - Critical - Cross Site Request Forgery - SA-CONTRIB-2021-040
by security-news＠drupal.org 22 Sep '21

22 Sep '21

View online: https://www.drupal.org/sa-contrib-2021-040 Project: The Better Mega Menu [1] Date: 2021-September-22 Security risk: *Critical* 15∕25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Request Forgery Description: This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content. The module does not use CSRF tokens to protect routes for saving menu configurations. This vulnerability can be exploited by an anonymous user. Solution: Install the latest version: * If you use the TB Mega Menu module for Drupal 8.x, upgrade to TB MegaMenu 8.x-1.4 [3] Reported By: * Patrick Fey [4] Fixed By: * Patrick Fey [5] * knaffles [6] Coordinated By: * Damien McKenna [7] of the Drupal Security Team [1] https://www.drupal.org/project/tb_megamenu [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/tb_megamenu/releases/8.x-1.4 [4] https://www.drupal.org/user/998680 [5] https://www.drupal.org/user/998680 [6] https://www.drupal.org/user/1140512 [7] https://www.drupal.org/u/damienmckenna

1 0

The Better Mega Menu - Moderately critical - Access bypass - SA-CONTRIB-2021-041
by security-news＠drupal.org 22 Sep '21

22 Sep '21

View online: https://www.drupal.org/sa-contrib-2021-041 Project: The Better Mega Menu [1] Date: 2021-September-22 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:Default [2] Vulnerability: Access bypass Description: This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content. This module has a vulnerability whereby users can select blocks as a menu item they don't have permission to view. The vulnerability is mitigated by the fact that it can only be exploited by an attacker with the "Administer TB Mega Menu" permission. Solution: Install the latest version: * If you use the TB Mega Menu module for Drupal 8.x, upgrade to TB MegaMenu 8.x-1.4 [3] Reported By: * Patrick Fey [4] Fixed By: * Patrick Fey [5] * Henry Odiete [6] * quondam [7] Coordinated By: * Damien McKenna [8] of the Drupal Security Team [1] https://www.drupal.org/project/tb_megamenu [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/tb_megamenu/releases/8.x-1.4 [4] https://www.drupal.org/user/998680 [5] https://www.drupal.org/user/998680 [6] https://www.drupal.org/user/3578705 [7] https://www.drupal.org/user/327869 [8] https://www.drupal.org/u/damienmckenna

1 0

Taxonomy Manager - Moderately critical - Access bypass - SA-CONTRIB-2021-035
by security-news＠drupal.org 22 Sep '21

22 Sep '21

View online: https://www.drupal.org/sa-contrib-2021-035 Project: Taxonomy Manager [1] Date: 2021-September-22 Security risk: *Moderately critical* 10∕25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Description: This module provides a powerful interface for managing a taxonomy vocabulary. A vocabulary gets displayed in a dynamic tree view, where parent terms can be expanded to list their nested child terms or can be collapsed. The module does not take the correct user permissions into account, allowing an attacker to delete and move terms. The issue is mitigated by the fact that an attacker must have permission to create terms in the targeted vocabulary. Solution: Install the latest version: * If you use the Taxonomy Manager module for Drupal 8 or 9, upgrade to Taxonomy Manager 2.0.6 [3] Reported By: * Klaus Purer [4] Fixed By: * Matthias Hutterer [5] * Klaus Purer [6] * Ales Bencina [7] Coordinated By: * Damien McKenna [8] of the Drupal Security Team * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/taxonomy_manager [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/taxonomy_manager/releases/2.0.6 [4] https://www.drupal.org/user/262198 [5] https://www.drupal.org/user/59747 [6] https://www.drupal.org/user/262198 [7] https://www.drupal.org/user/3558110 [8] https://www.drupal.org/u/damienmckenna [9] https://www.drupal.org/u/greggles

1 0

Search API attachments - Critical - Arbitrary PHP code execution - SA-CONTRIB-2021-034
by security-news＠drupal.org 22 Sep '21

22 Sep '21

View online: https://www.drupal.org/sa-contrib-2021-034 Project: Search API attachments [1] Date: 2021-September-22 Security risk: *Critical* 15∕25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Default [2] Vulnerability: Arbitrary PHP code execution Description: This module enables you to extract the textual content of files for use on a website, e.g. to display it or or use it in search indexes. The module doesn't sufficiently protect the administrator-defined commands which are executed on the server, which leads to post-authentication remote code execution by a limited set of users. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer search_api". Sites are encouraged to review which roles have that permission and which users have that role, to ensure that only trusted users have that permission. Solution: Install the latest version: * If you use the search_api_attachments module for Drupal 7.x, upgrade to search_api_attachments 7.x-1.19 [3] The 8.x branch does not have Security Coverage. Reported By: * Florent Torregrosa [4] Fixed By: * Damien McKenna [5] of the Drupal Security Team * Ismaeil Abouljamal [6] Coordinated By: * Damien McKenna [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/search_api_attachments [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/search_api_attachments/releases/7.x-1.19 [4] https://www.drupal.org/user/2388214 [5] https://www.drupal.org/user/108450 [6] https://www.drupal.org/user/514568 [7] https://www.drupal.org/u/damienmckenna [8] https://www.drupal.org/u/greggles

1 0

File Extractor - Critical - Arbitrary PHP code execution - SA-CONTRIB-2021-033
by security-news＠drupal.org 22 Sep '21

22 Sep '21

View online: https://www.drupal.org/sa-contrib-2021-033 Project: File Extractor [1] Date: 2021-September-22 Security risk: *Critical* 15∕25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Default [2] Vulnerability: Arbitrary PHP code execution Description: This module enables you to extract the textual content of files for use on a website, e.g. to display it or or use it in search indexes. The module doesn't sufficiently protect the administrator-defined commands which are executed on the server, which leads to post-authentication remote code execution by a limited set of users. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer File Extractor" to access the settings form. Sites are encouraged to review which roles have that permission and which users have that role, to ensure that only trusted users have that permission. Solution: Install the latest version: * If you use the File Extractor 2.0.2 or below, upgrade to File Extractor 2.0.3 [3] * If you use the File Extractor 3.0.0, upgrade to File Extractor 3.0.1 [4] * If you use the File Extractor 4.0.0, upgrade to File Extractor 4.0.1 [5] Reported By: * Florent Torregrosa [6] Fixed By: * Florent Torregrosa [7] Coordinated By: * Damien McKenna [8] of the Drupal Security Team [1] https://www.drupal.org/project/file_extractor [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/file_extractor/releases/2.0.3 [4] https://www.drupal.org/project/file_extractor/releases/3.0.1 [5] https://www.drupal.org/project/file_extractor/releases/4.0.1 [6] https://www.drupal.org/user/2388214 [7] https://www.drupal.org/user/2388214 [8] https://www.drupal.org/u/damienmckenna

1 0