Security-news September 2021

security-news@drupal.org

1 participants
20 discussions

Commerce Core - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2021-032
by security-news＠drupal.org 22 Sep '21

22 Sep '21

View online: https://www.drupal.org/sa-contrib-2021-032 Project: Commerce Core [1] Date: 2021-September-22 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass, Information Disclosure Description: This module provides a system for building an ecommerce solution in their Drupal site. The module doesn't sufficiently verify access to profile data in certain circumstances. This vulnerability is mitigated by the fact that an attacker must have permission to perform the checkout operation. Solution: Install the latest version: * If you use the Commerce module for Drupal 8.x, upgrade to Commerce 8.x-2.27 [3] Reported By: * Sasanka Jandhyala [4] Fixed By: * Sasanka Jandhyala [5] * Matt Glaman [6] * Jonathan Sacksick [7] Coordinated By: * Damien McKenna [8] of the Drupal Security Team [1] https://www.drupal.org/project/commerce [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/commerce/releases/8.x-2.27 [4] https://www.drupal.org/user/3541248 [5] https://www.drupal.org/user/3541248 [6] https://www.drupal.org/user/2416470 [7] https://www.drupal.org/user/972218 [8] https://www.drupal.org/u/damienmckenna

1 0

Client-side Hierarchical Select - Moderately critical - Cross-site scripting - SA-CONTRIB-2021-031
by security-news＠drupal.org 22 Sep '21

22 Sep '21

View online: https://www.drupal.org/sa-contrib-2021-031 Project: Client-side Hierarchical Select [1] Date: 2021-September-22 Security risk: *Moderately critical* 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross-site scripting Description: The module provides a field widget for selecting taxonomy terms in a hierarchical fashion. The module doesn't sanitize user input in certain cases, leading to a possible Cross-Site-Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit taxonomy terms to which the widget may apply. Solution: Install the latest version: * If you use the cshs module for Drupal 8 or 9, upgrade to Client-side Hierarchical Select 8.x-3.5 [3]. Reported By: * Patrick Fey [4] Fixed By: * Sergii Bondarenko [5] * Patrick Fey [6] Coordinated By: * Damien McKenna [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/cshs [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/cshs/releases/8.x-3.5 [4] https://www.drupal.org/user/998680 [5] https://www.drupal.org/user/2802285 [6] https://www.drupal.org/user/998680 [7] https://www.drupal.org/u/damienmckenna [8] https://www.drupal.org/u/greggles

1 0

User hash - Moderately critical - Cache poisoning - SA-CONTRIB-2021-030
by security-news＠drupal.org 22 Sep '21

22 Sep '21

View online: https://www.drupal.org/sa-contrib-2021-030 Project: User hash [1] Date: 2021-September-22 Security risk: *Moderately critical* 12∕25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Cache poisoning Description: This module enables you to create an individual hash for each user. These hashes can be used for authentication instead of the user's password, e.g. for views exporters. The module doesn't sufficiently invalidate page output when the page_cache module is used. This vulnerability is mitigated by the fact that an attacker must have a user hash that grants access to specific content and the attack must be timed to the reset of the page cache. Solution: Install the latest version: * If you use the user_hash module for Drupal 8 or 9, upgrade to User Hash 2.0.1 [3] Reported By: * Jürgen Haas [4] * Lee Rowlands [5] of the Drupal Security Team Fixed By: * Jürgen Haas [6] * Lee Rowlands [7] of the Drupal Security Team Coordinated By: * Damien McKenna [8] of the Drupal Security Team [1] https://www.drupal.org/project/user_hash [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/user_hash/releases/2.0.1 [4] https://www.drupal.org/user/168924 [5] https://www.drupal.org/user/395439 [6] https://www.drupal.org/user/168924 [7] https://www.drupal.org/user/395439 [8] https://www.drupal.org/u/damienmckenna

1 0

GraphQL - Moderately critical - Access bypass - SA-CONTRIB-2021-029
by security-news＠drupal.org 15 Sep '21

15 Sep '21

View online: https://www.drupal.org/sa-contrib-2021-029 Project: GraphQL [1] Date: 2021-September-15 Security risk: *Moderately critical* 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass CVE IDs: CVE-2020-13675 Description: This advisory addresses a similar issue to Drupal core - Moderately critical - Access bypass - SA-CORE-2021-008 [3]. The GraphQL module allows file uploads through its HTTP API. The module does not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site. This vulnerability is mitigated by four factors: 1) The GraphQL module must be enabled on the site. 2) The GraphQL schema must expose a file upload by using the helper "src/GraphQL/Utility/FileUpload.php" in the module. 3) An attacker must have access to that file upload via the GraphQL API. 4) The site must employ a file validation module. Solution: Install the latest version: * If you use the GraphQL module 8.x-4.x for Drupal 8.x or 9.x, upgrade to GraphQL 8.x-4.2 [4] * If you use the GraphQL module 8.x-3.x for Drupal 8.x no action is needed as a result of this advisory as the 8.x-3.x branch is not affected by this issue. Reported By: * Klaus Purer [5] Fixed By: * Klaus Purer [6] * Jess [7] of the Drupal Security Team * pmelab [8] * Drew Webber [9] of the Drupal Security Team * Lee Rowlands [10] of the Drupal Security Team * Alex Pott [11] of the Drupal Security Team * Samuel Mortenson [12] * Kim Pepper [13] Coordinated By: * xjm [14] of the Drupal Security Team * Drew Webber [15] of the Drupal Security Team [1] https://www.drupal.org/project/graphql [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/sa-core-2021-008 [4] https://www.drupal.org/project/graphql/releases/8.x-4.2 [5] https://www.drupal.org/user/262198 [6] https://www.drupal.org/user/262198 [7] https://www.drupal.org/user/65776 [8] https://www.drupal.org/user/555322 [9] https://www.drupal.org/user/255969 [10] https://www.drupal.org/user/395439 [11] https://www.drupal.org/user/157725 [12] https://www.drupal.org/user/2582268 [13] https://www.drupal.org/user/370574 [14] https://www.drupal.org/u/xjm [15] https://www.drupal.org/u/mcdruid

1 0

Entity Embed - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2021-028
by security-news＠drupal.org 15 Sep '21

15 Sep '21

View online: https://www.drupal.org/sa-contrib-2021-028 Project: Entity Embed [1] Date: 2021-September-15 Security risk: *Moderately critical* 11∕25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Request Forgery CVE IDs: CVE-2020-13673 Description: This advisory addresses a similar issue to Drupal core - Moderately critical - Cross Site Request Forgery - SA-CORE-2021-006 [3]. The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to cross-site scripting. Solution: Install the latest version: * If you use the Entity Embed module for Drupal 8 or 9, upgrade to Entity Embed 8.x-1.2 [4]. Drupal 7 versions of Entity Embed do not have a stable release and therefore do not receive security coverage. Reported By: * Aaron Zinck [5] Fixed By: * Jess [6] of the Drupal Security Team * Adam G-H [7] * Drew Webber [8] of the Drupal Security Team Coordinated By: * xjm [9] of the Drupal Security Team * Drew Webber [10] of the Drupal Security Team [1] https://www.drupal.org/project/entity_embed [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/sa-core-2021-006 [4] https://www.drupal.org/project/entity_embed/releases/8.x-1.2 [5] https://www.drupal.org/user/518662 [6] https://www.drupal.org/user/65776 [7] https://www.drupal.org/user/205645 [8] https://www.drupal.org/user/255969 [9] https://www.drupal.org/u/xjm [10] https://www.drupal.org/u/mcdruid

1 0

Drupal core - Moderately critical - Access Bypass - SA-CORE-2021-010
by security-news＠drupal.org 15 Sep '21

15 Sep '21

View online: https://www.drupal.org/sa-core-2021-010 Project: Drupal core [1] Date: 2021-September-15 Security risk: *Moderately critical* 12∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access Bypass CVE IDs: CVE-2020-13677 Description: Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not have the JSON:API module enabled are not affected. This advisory is not covered by Drupal Steward [3]. Solution: Install the latest version: * If you are using Drupal 9.2, update to Drupal 9.2.6 [4]. * If you are using Drupal 9.1, update to Drupal 9.1.13 [5]. * If you are using Drupal 8.9, update to Drupal 8.9.19 [6]. Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage. Drupal 7 core does not include the JSON:API module and therefore is not affected. Reported By: * Brad Jones [7] Fixed By: * Brad Jones [8] * Jess [9] of the Drupal Security Team * Björn Brala [10] * Gabe Sullice [11] * Mateu Aguiló Bosch [12] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/steward [4] https://www.drupal.org/project/drupal/releases/9.2.6 [5] https://www.drupal.org/project/drupal/releases/9.1.13 [6] https://www.drupal.org/project/drupal/releases/8.9.19 [7] https://www.drupal.org/user/405824 [8] https://www.drupal.org/user/405824 [9] https://www.drupal.org/user/65776 [10] https://www.drupal.org/user/3366066 [11] https://www.drupal.org/user/2287430 [12] https://www.drupal.org/user/550110

1 0

Drupal core - Moderately critical - Access bypass - SA-CORE-2021-009
by security-news＠drupal.org 15 Sep '21

15 Sep '21

View online: https://www.drupal.org/sa-core-2021-009 Project: Drupal core [1] Date: 2021-September-15 Security risk: *Moderately critical* 10∕25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass CVE IDs: CVE-2020-13676 Description: The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. This advisory is not covered by Drupal Steward [3]. Solution: Install the latest version: * If you are using Drupal 9.2, update to Drupal 9.2.6 [4]. * If you are using Drupal 9.1, update to Drupal 9.1.13 [5]. * If you are using Drupal 8.9, update to Drupal 8.9.19 [6]. Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage. Drupal 7 core does not include the QuickEdit module and therefore is not affected. Uninstalling the QuickEdit module will also mitigate the vulnerability. Site owners may wish to consider this option as the QuickEdit module will be removed from core in Drupal 10 [7]. Reported By: * Greg Watson [8] Fixed By: * Greg Watson [9] * Wim Leers [10] * Jess [11] of the Drupal Security Team * Alex Bronstein [12] of the Drupal Security Team * Lee Rowlands [13] of the Drupal Security Team * Joseph Zhao [14] * Vijay Mani [15] * Adam G-H [16] * Drew Webber [17] of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/steward [4] https://www.drupal.org/project/drupal/releases/9.2.6 [5] https://www.drupal.org/project/drupal/releases/9.1.13 [6] https://www.drupal.org/project/drupal/releases/8.9.19 [7] https://www.drupal.org/node/3227039 [8] https://www.drupal.org/user/2212910 [9] https://www.drupal.org/user/2212910 [10] https://www.drupal.org/user/99777 [11] https://www.drupal.org/user/65776 [12] https://www.drupal.org/user/78040 [13] https://www.drupal.org/user/395439 [14] https://www.drupal.org/user/1987218 [15] https://www.drupal.org/user/93488 [16] https://www.drupal.org/user/205645 [17] https://www.drupal.org/user/255969

1 0

Drupal core - Moderately critical - Access bypass - SA-CORE-2021-008
by security-news＠drupal.org 15 Sep '21

15 Sep '21

View online: https://www.drupal.org/sa-core-2021-008 Project: Drupal core [1] Date: 2021-September-15 Security risk: *Moderately critical* 11∕25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass CVE IDs: CVE-2020-13675 Description: Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site. This vulnerability is mitigated by three factors: 1) The JSON:API or REST File upload modules must be enabled on the site. 2) An attacker must have access to a file upload via JSON:API or REST. 3) The site must employ a file validation module. This advisory is not covered by Drupal Steward [3]. Also see GraphQL - Moderately critical - Access bypass - SA-CONTRIB-2021-029 [4] which addresses a similar vulnerability for that module. Solution: Install the latest version: * If you are using Drupal 9.2, update to Drupal 9.2.6 [5]. * If you are using Drupal 9.1, update to Drupal 9.1.13 [6]. * If you are using Drupal 8.9, update to Drupal 8.9.19 [7]. Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage. Drupal 7 core is not affected. Reported By: * Klaus Purer [8] Fixed By: * Klaus Purer [9] * Lee Rowlands [10] of the Drupal Security Team * Alex Pott [11] of the Drupal Security Team * Jess [12] of the Drupal Security Team * Samuel Mortenson [13] * Drew Webber [14] of the Drupal Security Team * Kim Pepper [15] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/steward [4] https://www.drupal.org/sa-contrib-2021-029 [5] https://www.drupal.org/project/drupal/releases/9.2.6 [6] https://www.drupal.org/project/drupal/releases/9.1.13 [7] https://www.drupal.org/project/drupal/releases/8.9.19 [8] https://www.drupal.org/user/262198 [9] https://www.drupal.org/user/262198 [10] https://www.drupal.org/user/395439 [11] https://www.drupal.org/user/157725 [12] https://www.drupal.org/user/65776 [13] https://www.drupal.org/user/2582268 [14] https://www.drupal.org/user/255969 [15] https://www.drupal.org/user/370574

1 0

Drupal core - Moderately critical - Cross Site Request Forgery - SA-CORE-2021-007
by security-news＠drupal.org 15 Sep '21

15 Sep '21

View online: https://www.drupal.org/sa-core-2021-007 Project: Drupal core [1] Date: 2021-September-15 Security risk: *Moderately critical* 14∕25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Request Forgery CVE IDs: CVE-2020-13674 Description: The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. Removing the "access in-place editing" permission from untrusted users *will not* fully mitigate the vulnerability. This advisory is not covered by Drupal Steward [3]. Solution: Install the latest version: * If you are using Drupal 9.2, update to Drupal 9.2.6 [4]. * If you are using Drupal 9.1, update to Drupal 9.1.13 [5]. * If you are using Drupal 8.9, update to Drupal 8.9.19 [6]. Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage. Drupal 7 core does not include the QuickEdit module and therefore is not affected. Uninstalling the QuickEdit module will also mitigate the vulnerability. Site owners may wish to consider this option as the QuickEdit module will be removed from core in Drupal 10 [7]. Reported By: * Samuel Mortenson [8] Fixed By: * Wim Leers [9] * Greg Knaddison [10] of the Drupal Security Team * Jess [11] of the Drupal Security Team * Lee Rowlands [12] of the Drupal Security Team * Vijay Mani [13] * Heine [14] of the Drupal Security Team * Alex Bronstein [15] of the Drupal Security Team * Adam G-H [16] * Drew Webber [17] of the Drupal Security Team * Théodore Biadala [18] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/steward [4] https://www.drupal.org/project/drupal/releases/9.2.6 [5] https://www.drupal.org/project/drupal/releases/9.1.13 [6] https://www.drupal.org/project/drupal/releases/8.9.19 [7] https://www.drupal.org/node/3227039 [8] https://www.drupal.org/user/2582268 [9] https://www.drupal.org/user/99777 [10] https://www.drupal.org/user/36762 [11] https://www.drupal.org/user/65776 [12] https://www.drupal.org/user/395439 [13] https://www.drupal.org/user/93488 [14] https://www.drupal.org/user/17943 [15] https://www.drupal.org/user/78040 [16] https://www.drupal.org/user/205645 [17] https://www.drupal.org/user/255969 [18] https://www.drupal.org/user/598310

1 0

Drupal core - Moderately critical - Cross Site Request Forgery - SA-CORE-2021-006
by security-news＠drupal.org 15 Sep '21

15 Sep '21

View online: https://www.drupal.org/sa-core-2021-006 Project: Drupal core [1] Date: 2021-September-15 Security risk: *Moderately critical* 10∕25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Request Forgery CVE IDs: CVE-2020-13673 Description: The Drupal core Media module provides a filter to allow embedding internal and external media in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed media. In some cases, this could lead to cross-site scripting. This advisory is not covered by Drupal Steward [3]. Also see Entity Embed - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2021-028 [4] which addresses a similar vulnerability for that module. Solution: Install the latest version: * If you are using Drupal 9.2, update to Drupal 9.2.6 [5]. * If you are using Drupal 9.1, update to Drupal 9.1.13 [6]. * If you are using Drupal 8.9, update to Drupal 8.9.19 [7]. Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage. Drupal 7 core is not affected. Reported By: * Aaron Zinck [8] Fixed By: * Aaron Zinck [9] * Sean Blommaert [10] * Alex Bronstein [11] of the Drupal Security Team * Marcos Cano [12] * Lee Rowlands [13] of the Drupal Security Team * Adam G-H [14] * Jess [15] of the Drupal Security Team * Drew Webber [16] of the Drupal Security Team * Neil Drumm [17] of the Drupal Security Team * Brian Tofte-Schumacher [18] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/steward [4] https://www.drupal.org/sa-contrib-2021-028 [5] https://www.drupal.org/project/drupal/releases/9.2.6 [6] https://www.drupal.org/project/drupal/releases/9.1.13 [7] https://www.drupal.org/project/drupal/releases/8.9.19 [8] https://www.drupal.org/user/518662 [9] https://www.drupal.org/user/518662 [10] https://www.drupal.org/user/545912 [11] https://www.drupal.org/user/78040 [12] https://www.drupal.org/user/1288796 [13] https://www.drupal.org/user/395439 [14] https://www.drupal.org/user/205645 [15] https://www.drupal.org/user/65776 [16] https://www.drupal.org/user/255969 [17] https://www.drupal.org/user/3064 [18] https://www.drupal.org/user/3525810

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news September 2021