lists.drupal.org
Sign In
Sign Up
Sign In
Sign Up
Manage this list
×
Keyboard Shortcuts
Thread View
j
: Next unread message
k
: Previous unread message
j a
: Jump to all threads
j l
: Jump to MailingList overview
2026
February
January
2025
December
November
October
September
August
July
June
May
April
March
February
January
2024
December
November
October
September
August
July
June
May
April
March
February
January
2023
December
November
October
September
August
July
June
May
April
March
February
January
2022
December
November
October
September
August
July
June
May
April
March
February
January
2021
December
November
October
September
August
July
June
May
April
March
February
January
2020
December
November
October
September
August
July
June
May
April
March
February
January
2019
December
November
October
September
August
July
June
May
April
March
February
January
2018
December
November
October
September
August
July
June
May
April
March
February
January
2017
December
November
October
September
August
July
June
May
April
March
February
January
2016
December
November
October
September
August
July
June
May
April
March
February
January
2015
December
November
October
September
August
July
June
May
April
March
February
January
2014
December
November
October
September
August
July
June
May
April
March
February
January
2013
December
November
October
September
August
July
June
May
April
March
February
January
2012
December
November
October
September
August
July
June
May
April
March
February
January
2011
December
November
October
September
August
July
June
May
April
March
February
January
2010
December
November
October
September
August
July
June
May
April
March
February
January
2009
December
November
October
September
August
July
June
May
April
March
February
List overview
Download
Security-news
September 2021
----- 2026 -----
February 2026
January 2026
----- 2025 -----
December 2025
November 2025
October 2025
September 2025
August 2025
July 2025
June 2025
May 2025
April 2025
March 2025
February 2025
January 2025
----- 2024 -----
December 2024
November 2024
October 2024
September 2024
August 2024
July 2024
June 2024
May 2024
April 2024
March 2024
February 2024
January 2024
----- 2023 -----
December 2023
November 2023
October 2023
September 2023
August 2023
July 2023
June 2023
May 2023
April 2023
March 2023
February 2023
January 2023
----- 2022 -----
December 2022
November 2022
October 2022
September 2022
August 2022
July 2022
June 2022
May 2022
April 2022
March 2022
February 2022
January 2022
----- 2021 -----
December 2021
November 2021
October 2021
September 2021
August 2021
July 2021
June 2021
May 2021
April 2021
March 2021
February 2021
January 2021
----- 2020 -----
December 2020
November 2020
October 2020
September 2020
August 2020
July 2020
June 2020
May 2020
April 2020
March 2020
February 2020
January 2020
----- 2019 -----
December 2019
November 2019
October 2019
September 2019
August 2019
July 2019
June 2019
May 2019
April 2019
March 2019
February 2019
January 2019
----- 2018 -----
December 2018
November 2018
October 2018
September 2018
August 2018
July 2018
June 2018
May 2018
April 2018
March 2018
February 2018
January 2018
----- 2017 -----
December 2017
November 2017
October 2017
September 2017
August 2017
July 2017
June 2017
May 2017
April 2017
March 2017
February 2017
January 2017
----- 2016 -----
December 2016
November 2016
October 2016
September 2016
August 2016
July 2016
June 2016
May 2016
April 2016
March 2016
February 2016
January 2016
----- 2015 -----
December 2015
November 2015
October 2015
September 2015
August 2015
July 2015
June 2015
May 2015
April 2015
March 2015
February 2015
January 2015
----- 2014 -----
December 2014
November 2014
October 2014
September 2014
August 2014
July 2014
June 2014
May 2014
April 2014
March 2014
February 2014
January 2014
----- 2013 -----
December 2013
November 2013
October 2013
September 2013
August 2013
July 2013
June 2013
May 2013
April 2013
March 2013
February 2013
January 2013
----- 2012 -----
December 2012
November 2012
October 2012
September 2012
August 2012
July 2012
June 2012
May 2012
April 2012
March 2012
February 2012
January 2012
----- 2011 -----
December 2011
November 2011
October 2011
September 2011
August 2011
July 2011
June 2011
May 2011
April 2011
March 2011
February 2011
January 2011
----- 2010 -----
December 2010
November 2010
October 2010
September 2010
August 2010
July 2010
June 2010
May 2010
April 2010
March 2010
February 2010
January 2010
----- 2009 -----
December 2009
November 2009
October 2009
September 2009
August 2009
July 2009
June 2009
May 2009
April 2009
March 2009
February 2009
security-news@drupal.org
1 participants
20 discussions
Start a n
N
ew thread
Commerce Core - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2021-032
by security-news@drupal.org
22 Sep '21
22 Sep '21
View online:
https://www.drupal.org/sa-contrib-2021-032
Project: Commerce Core [1] Date: 2021-September-22 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass, Information Disclosure Description: This module provides a system for building an ecommerce solution in their Drupal site. The module doesn't sufficiently verify access to profile data in certain circumstances. This vulnerability is mitigated by the fact that an attacker must have permission to perform the checkout operation. Solution: Install the latest version: * If you use the Commerce module for Drupal 8.x, upgrade to Commerce 8.x-2.27 [3] Reported By: * Sasanka Jandhyala [4] Fixed By: * Sasanka Jandhyala [5] * Matt Glaman [6] * Jonathan Sacksick [7] Coordinated By: * Damien McKenna [8] of the Drupal Security Team [1]
https://www.drupal.org/project/commerce
[2]
https://www.drupal.org/security-team/risk-levels
[3]
https://www.drupal.org/project/commerce/releases/8.x-2.27
[4]
https://www.drupal.org/user/3541248
[5]
https://www.drupal.org/user/3541248
[6]
https://www.drupal.org/user/2416470
[7]
https://www.drupal.org/user/972218
[8]
https://www.drupal.org/u/damienmckenna
1
0
0
0
Client-side Hierarchical Select - Moderately critical - Cross-site scripting - SA-CONTRIB-2021-031
by security-news@drupal.org
22 Sep '21
22 Sep '21
View online:
https://www.drupal.org/sa-contrib-2021-031
Project: Client-side Hierarchical Select [1] Date: 2021-September-22 Security risk: *Moderately critical* 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross-site scripting Description: The module provides a field widget for selecting taxonomy terms in a hierarchical fashion. The module doesn't sanitize user input in certain cases, leading to a possible Cross-Site-Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit taxonomy terms to which the widget may apply. Solution: Install the latest version: * If you use the cshs module for Drupal 8 or 9, upgrade to Client-side Hierarchical Select 8.x-3.5 [3]. Reported By: * Patrick Fey [4] Fixed By: * Sergii Bondarenko [5] * Patrick Fey [6] Coordinated By: * Damien McKenna [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1]
https://www.drupal.org/project/cshs
[2]
https://www.drupal.org/security-team/risk-levels
[3]
https://www.drupal.org/project/cshs/releases/8.x-3.5
[4]
https://www.drupal.org/user/998680
[5]
https://www.drupal.org/user/2802285
[6]
https://www.drupal.org/user/998680
[7]
https://www.drupal.org/u/damienmckenna
[8]
https://www.drupal.org/u/greggles
1
0
0
0
User hash - Moderately critical - Cache poisoning - SA-CONTRIB-2021-030
by security-news@drupal.org
22 Sep '21
22 Sep '21
View online:
https://www.drupal.org/sa-contrib-2021-030
Project: User hash [1] Date: 2021-September-22 Security risk: *Moderately critical* 12∕25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Cache poisoning Description: This module enables you to create an individual hash for each user. These hashes can be used for authentication instead of the user's password, e.g. for views exporters. The module doesn't sufficiently invalidate page output when the page_cache module is used. This vulnerability is mitigated by the fact that an attacker must have a user hash that grants access to specific content and the attack must be timed to the reset of the page cache. Solution: Install the latest version: * If you use the user_hash module for Drupal 8 or 9, upgrade to User Hash 2.0.1 [3] Reported By: * Jürgen Haas [4] * Lee Rowlands [5] of the Drupal Security Team Fixed By: * Jürgen Haas [6] * Lee Rowlands [7] of the Drupal Security Team Coordinated By: * Damien McKenna [8] of the Drupal Security Team [1]
https://www.drupal.org/project/user_hash
[2]
https://www.drupal.org/security-team/risk-levels
[3]
https://www.drupal.org/project/user_hash/releases/2.0.1
[4]
https://www.drupal.org/user/168924
[5]
https://www.drupal.org/user/395439
[6]
https://www.drupal.org/user/168924
[7]
https://www.drupal.org/user/395439
[8]
https://www.drupal.org/u/damienmckenna
1
0
0
0
GraphQL - Moderately critical - Access bypass - SA-CONTRIB-2021-029
by security-news@drupal.org
15 Sep '21
15 Sep '21
View online:
https://www.drupal.org/sa-contrib-2021-029
Project: GraphQL [1] Date: 2021-September-15 Security risk: *Moderately critical* 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass CVE IDs: CVE-2020-13675 Description: This advisory addresses a similar issue to Drupal core - Moderately critical - Access bypass - SA-CORE-2021-008 [3]. The GraphQL module allows file uploads through its HTTP API. The module does not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site. This vulnerability is mitigated by four factors: 1) The GraphQL module must be enabled on the site. 2) The GraphQL schema must expose a file upload by using the helper "src/GraphQL/Utility/FileUpload.php" in the module. 3) An attacker must have access to that file upload via the GraphQL API. 4) The site must employ a file validation module. Solution: Install the latest version: * If you use the GraphQL module 8.x-4.x for Drupal 8.x or 9.x, upgrade to GraphQL 8.x-4.2 [4] * If you use the GraphQL module 8.x-3.x for Drupal 8.x no action is needed as a result of this advisory as the 8.x-3.x branch is not affected by this issue. Reported By: * Klaus Purer [5] Fixed By: * Klaus Purer [6] * Jess [7] of the Drupal Security Team * pmelab [8] * Drew Webber [9] of the Drupal Security Team * Lee Rowlands [10] of the Drupal Security Team * Alex Pott [11] of the Drupal Security Team * Samuel Mortenson [12] * Kim Pepper [13] Coordinated By: * xjm [14] of the Drupal Security Team * Drew Webber [15] of the Drupal Security Team [1]
https://www.drupal.org/project/graphql
[2]
https://www.drupal.org/security-team/risk-levels
[3]
https://www.drupal.org/sa-core-2021-008
[4]
https://www.drupal.org/project/graphql/releases/8.x-4.2
[5]
https://www.drupal.org/user/262198
[6]
https://www.drupal.org/user/262198
[7]
https://www.drupal.org/user/65776
[8]
https://www.drupal.org/user/555322
[9]
https://www.drupal.org/user/255969
[10]
https://www.drupal.org/user/395439
[11]
https://www.drupal.org/user/157725
[12]
https://www.drupal.org/user/2582268
[13]
https://www.drupal.org/user/370574
[14]
https://www.drupal.org/u/xjm
[15]
https://www.drupal.org/u/mcdruid
1
0
0
0
Entity Embed - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2021-028
by security-news@drupal.org
15 Sep '21
15 Sep '21
View online:
https://www.drupal.org/sa-contrib-2021-028
Project: Entity Embed [1] Date: 2021-September-15 Security risk: *Moderately critical* 11∕25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Request Forgery CVE IDs: CVE-2020-13673 Description: This advisory addresses a similar issue to Drupal core - Moderately critical - Cross Site Request Forgery - SA-CORE-2021-006 [3]. The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to cross-site scripting. Solution: Install the latest version: * If you use the Entity Embed module for Drupal 8 or 9, upgrade to Entity Embed 8.x-1.2 [4]. Drupal 7 versions of Entity Embed do not have a stable release and therefore do not receive security coverage. Reported By: * Aaron Zinck [5] Fixed By: * Jess [6] of the Drupal Security Team * Adam G-H [7] * Drew Webber [8] of the Drupal Security Team Coordinated By: * xjm [9] of the Drupal Security Team * Drew Webber [10] of the Drupal Security Team [1]
https://www.drupal.org/project/entity_embed
[2]
https://www.drupal.org/security-team/risk-levels
[3]
https://www.drupal.org/sa-core-2021-006
[4]
https://www.drupal.org/project/entity_embed/releases/8.x-1.2
[5]
https://www.drupal.org/user/518662
[6]
https://www.drupal.org/user/65776
[7]
https://www.drupal.org/user/205645
[8]
https://www.drupal.org/user/255969
[9]
https://www.drupal.org/u/xjm
[10]
https://www.drupal.org/u/mcdruid
1
0
0
0
Drupal core - Moderately critical - Access Bypass - SA-CORE-2021-010
by security-news@drupal.org
15 Sep '21
15 Sep '21
View online:
https://www.drupal.org/sa-core-2021-010
Project: Drupal core [1] Date: 2021-September-15 Security risk: *Moderately critical* 12∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access Bypass CVE IDs: CVE-2020-13677 Description: Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not have the JSON:API module enabled are not affected. This advisory is not covered by Drupal Steward [3]. Solution: Install the latest version: * If you are using Drupal 9.2, update to Drupal 9.2.6 [4]. * If you are using Drupal 9.1, update to Drupal 9.1.13 [5]. * If you are using Drupal 8.9, update to Drupal 8.9.19 [6]. Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage. Drupal 7 core does not include the JSON:API module and therefore is not affected. Reported By: * Brad Jones [7] Fixed By: * Brad Jones [8] * Jess [9] of the Drupal Security Team * Björn Brala [10] * Gabe Sullice [11] * Mateu Aguiló Bosch [12] [1]
https://www.drupal.org/project/drupal
[2]
https://www.drupal.org/security-team/risk-levels
[3]
https://www.drupal.org/steward
[4]
https://www.drupal.org/project/drupal/releases/9.2.6
[5]
https://www.drupal.org/project/drupal/releases/9.1.13
[6]
https://www.drupal.org/project/drupal/releases/8.9.19
[7]
https://www.drupal.org/user/405824
[8]
https://www.drupal.org/user/405824
[9]
https://www.drupal.org/user/65776
[10]
https://www.drupal.org/user/3366066
[11]
https://www.drupal.org/user/2287430
[12]
https://www.drupal.org/user/550110
1
0
0
0
Drupal core - Moderately critical - Access bypass - SA-CORE-2021-009
by security-news@drupal.org
15 Sep '21
15 Sep '21
View online:
https://www.drupal.org/sa-core-2021-009
Project: Drupal core [1] Date: 2021-September-15 Security risk: *Moderately critical* 10∕25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass CVE IDs: CVE-2020-13676 Description: The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. This advisory is not covered by Drupal Steward [3]. Solution: Install the latest version: * If you are using Drupal 9.2, update to Drupal 9.2.6 [4]. * If you are using Drupal 9.1, update to Drupal 9.1.13 [5]. * If you are using Drupal 8.9, update to Drupal 8.9.19 [6]. Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage. Drupal 7 core does not include the QuickEdit module and therefore is not affected. Uninstalling the QuickEdit module will also mitigate the vulnerability. Site owners may wish to consider this option as the QuickEdit module will be removed from core in Drupal 10 [7]. Reported By: * Greg Watson [8] Fixed By: * Greg Watson [9] * Wim Leers [10] * Jess [11] of the Drupal Security Team * Alex Bronstein [12] of the Drupal Security Team * Lee Rowlands [13] of the Drupal Security Team * Joseph Zhao [14] * Vijay Mani [15] * Adam G-H [16] * Drew Webber [17] of the Drupal Security Team [1]
https://www.drupal.org/project/drupal
[2]
https://www.drupal.org/security-team/risk-levels
[3]
https://www.drupal.org/steward
[4]
https://www.drupal.org/project/drupal/releases/9.2.6
[5]
https://www.drupal.org/project/drupal/releases/9.1.13
[6]
https://www.drupal.org/project/drupal/releases/8.9.19
[7]
https://www.drupal.org/node/3227039
[8]
https://www.drupal.org/user/2212910
[9]
https://www.drupal.org/user/2212910
[10]
https://www.drupal.org/user/99777
[11]
https://www.drupal.org/user/65776
[12]
https://www.drupal.org/user/78040
[13]
https://www.drupal.org/user/395439
[14]
https://www.drupal.org/user/1987218
[15]
https://www.drupal.org/user/93488
[16]
https://www.drupal.org/user/205645
[17]
https://www.drupal.org/user/255969
1
0
0
0
Drupal core - Moderately critical - Access bypass - SA-CORE-2021-008
by security-news@drupal.org
15 Sep '21
15 Sep '21
View online:
https://www.drupal.org/sa-core-2021-008
Project: Drupal core [1] Date: 2021-September-15 Security risk: *Moderately critical* 11∕25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass CVE IDs: CVE-2020-13675 Description: Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site. This vulnerability is mitigated by three factors: 1) The JSON:API or REST File upload modules must be enabled on the site. 2) An attacker must have access to a file upload via JSON:API or REST. 3) The site must employ a file validation module. This advisory is not covered by Drupal Steward [3]. Also see GraphQL - Moderately critical - Access bypass - SA-CONTRIB-2021-029 [4] which addresses a similar vulnerability for that module. Solution: Install the latest version: * If you are using Drupal 9.2, update to Drupal 9.2.6 [5]. * If you are using Drupal 9.1, update to Drupal 9.1.13 [6]. * If you are using Drupal 8.9, update to Drupal 8.9.19 [7]. Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage. Drupal 7 core is not affected. Reported By: * Klaus Purer [8] Fixed By: * Klaus Purer [9] * Lee Rowlands [10] of the Drupal Security Team * Alex Pott [11] of the Drupal Security Team * Jess [12] of the Drupal Security Team * Samuel Mortenson [13] * Drew Webber [14] of the Drupal Security Team * Kim Pepper [15] [1]
https://www.drupal.org/project/drupal
[2]
https://www.drupal.org/security-team/risk-levels
[3]
https://www.drupal.org/steward
[4]
https://www.drupal.org/sa-contrib-2021-029
[5]
https://www.drupal.org/project/drupal/releases/9.2.6
[6]
https://www.drupal.org/project/drupal/releases/9.1.13
[7]
https://www.drupal.org/project/drupal/releases/8.9.19
[8]
https://www.drupal.org/user/262198
[9]
https://www.drupal.org/user/262198
[10]
https://www.drupal.org/user/395439
[11]
https://www.drupal.org/user/157725
[12]
https://www.drupal.org/user/65776
[13]
https://www.drupal.org/user/2582268
[14]
https://www.drupal.org/user/255969
[15]
https://www.drupal.org/user/370574
1
0
0
0
Drupal core - Moderately critical - Cross Site Request Forgery - SA-CORE-2021-007
by security-news@drupal.org
15 Sep '21
15 Sep '21
View online:
https://www.drupal.org/sa-core-2021-007
Project: Drupal core [1] Date: 2021-September-15 Security risk: *Moderately critical* 14∕25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Request Forgery CVE IDs: CVE-2020-13674 Description: The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. Removing the "access in-place editing" permission from untrusted users *will not* fully mitigate the vulnerability. This advisory is not covered by Drupal Steward [3]. Solution: Install the latest version: * If you are using Drupal 9.2, update to Drupal 9.2.6 [4]. * If you are using Drupal 9.1, update to Drupal 9.1.13 [5]. * If you are using Drupal 8.9, update to Drupal 8.9.19 [6]. Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage. Drupal 7 core does not include the QuickEdit module and therefore is not affected. Uninstalling the QuickEdit module will also mitigate the vulnerability. Site owners may wish to consider this option as the QuickEdit module will be removed from core in Drupal 10 [7]. Reported By: * Samuel Mortenson [8] Fixed By: * Wim Leers [9] * Greg Knaddison [10] of the Drupal Security Team * Jess [11] of the Drupal Security Team * Lee Rowlands [12] of the Drupal Security Team * Vijay Mani [13] * Heine [14] of the Drupal Security Team * Alex Bronstein [15] of the Drupal Security Team * Adam G-H [16] * Drew Webber [17] of the Drupal Security Team * Théodore Biadala [18] [1]
https://www.drupal.org/project/drupal
[2]
https://www.drupal.org/security-team/risk-levels
[3]
https://www.drupal.org/steward
[4]
https://www.drupal.org/project/drupal/releases/9.2.6
[5]
https://www.drupal.org/project/drupal/releases/9.1.13
[6]
https://www.drupal.org/project/drupal/releases/8.9.19
[7]
https://www.drupal.org/node/3227039
[8]
https://www.drupal.org/user/2582268
[9]
https://www.drupal.org/user/99777
[10]
https://www.drupal.org/user/36762
[11]
https://www.drupal.org/user/65776
[12]
https://www.drupal.org/user/395439
[13]
https://www.drupal.org/user/93488
[14]
https://www.drupal.org/user/17943
[15]
https://www.drupal.org/user/78040
[16]
https://www.drupal.org/user/205645
[17]
https://www.drupal.org/user/255969
[18]
https://www.drupal.org/user/598310
1
0
0
0
Drupal core - Moderately critical - Cross Site Request Forgery - SA-CORE-2021-006
by security-news@drupal.org
15 Sep '21
15 Sep '21
View online:
https://www.drupal.org/sa-core-2021-006
Project: Drupal core [1] Date: 2021-September-15 Security risk: *Moderately critical* 10∕25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Request Forgery CVE IDs: CVE-2020-13673 Description: The Drupal core Media module provides a filter to allow embedding internal and external media in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed media. In some cases, this could lead to cross-site scripting. This advisory is not covered by Drupal Steward [3]. Also see Entity Embed - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2021-028 [4] which addresses a similar vulnerability for that module. Solution: Install the latest version: * If you are using Drupal 9.2, update to Drupal 9.2.6 [5]. * If you are using Drupal 9.1, update to Drupal 9.1.13 [6]. * If you are using Drupal 8.9, update to Drupal 8.9.19 [7]. Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage. Drupal 7 core is not affected. Reported By: * Aaron Zinck [8] Fixed By: * Aaron Zinck [9] * Sean Blommaert [10] * Alex Bronstein [11] of the Drupal Security Team * Marcos Cano [12] * Lee Rowlands [13] of the Drupal Security Team * Adam G-H [14] * Jess [15] of the Drupal Security Team * Drew Webber [16] of the Drupal Security Team * Neil Drumm [17] of the Drupal Security Team * Brian Tofte-Schumacher [18] [1]
https://www.drupal.org/project/drupal
[2]
https://www.drupal.org/security-team/risk-levels
[3]
https://www.drupal.org/steward
[4]
https://www.drupal.org/sa-contrib-2021-028
[5]
https://www.drupal.org/project/drupal/releases/9.2.6
[6]
https://www.drupal.org/project/drupal/releases/9.1.13
[7]
https://www.drupal.org/project/drupal/releases/8.9.19
[8]
https://www.drupal.org/user/518662
[9]
https://www.drupal.org/user/518662
[10]
https://www.drupal.org/user/545912
[11]
https://www.drupal.org/user/78040
[12]
https://www.drupal.org/user/1288796
[13]
https://www.drupal.org/user/395439
[14]
https://www.drupal.org/user/205645
[15]
https://www.drupal.org/user/65776
[16]
https://www.drupal.org/user/255969
[17]
https://www.drupal.org/user/3064
[18]
https://www.drupal.org/user/3525810
1
0
0
0
← Newer
1
2
Older →
Jump to page:
1
2
Results per page:
10
25
50
100
200