Security-news

Download

security-news@drupal.org

August 2022

1 participants
2 discussions

Commerce Elavon - Moderately critical - Access bypass - SA-CONTRIB-2022-053
by security-news＠drupal.org 24 Aug '22

24 Aug '22

View online: https://www.drupal.org/sa-contrib-2022-053 Project: Commerce Elavon [1] Version: 8.x-2.28.x-2.18.x-2.08.x-2.0-beta28.x-2.0-beta17.x-1.47.x-1.37.x-1.27.x-1.17.x-1.0 Date: 2022-August-24 Security risk: *Moderately critical* 11∕25 AC:Complex/A:None/CI:None/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <=2.2.0 Description: This module enables you to accept payments from the Elavon payment provider. The module doesn't sufficiently verify that it's communicating with the correct server when using the *Elavon (On-site)* payment gateway, which could lead to leaking valid payment details as well as accepting invalid payment details. This vulnerability is mitigated by the fact that an attacker must be able to spoof the Elavon DNS received by your site. Solution: Install the latest version: * If you use the Commerce Elavon module for Drupal 8.x/9.x, upgrade to Commerce Elavon 8.x-2.3 [3] * If you use the Commerce Elavon module version 1.x for Drupal 7.x, upgrade to Commerce Elavon 7.x-1.5 [4] Reported By: * Andy Fowlston [5] Fixed By: * Andy Fowlston [6] * Greg Knaddison [7] of the Drupal Security Team Coordinated By: * Damien McKenna [8] of the Drupal Security Team * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/commerce_elavon [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/commerce_elavon/releases/8.x-2.3 [4] https://www.drupal.org/project/commerce_elavon/releases/7.x-1.5 [5] https://www.drupal.org/user/220112 [6] https://www.drupal.org/user/220112 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/108450 [9] https://www.drupal.org/user/36762

1 0

jQuery UI Checkboxradio - Moderately critical - Cross site scripting - SA-CONTRIB-2022-052
by security-news＠drupal.org 10 Aug '22

10 Aug '22

View online: https://www.drupal.org/sa-contrib-2022-052 Project: jQuery UI Checkboxradio [1] Version: 8.x-1.38.x-1.28.x-1.18.x-1.0 Date: 2022-August-10 Security risk: *Moderately critical* 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:Uncommon [2] Vulnerability: Cross site scripting Description: jQuery UI is a third-party library used by Drupal. The jQuery UI Checkboxradio module provides the jQuery UI Checkboxradio library (which was previously in Drupal 8 core, but has since been removed from core and moved to this module). As part of the jQuery UI 1.13.2 update, the jQuery UI project disclosed following security issue that may affect sites using the jQuery UI Checkboxradio module: * CVE-2022-31160: XSS when refreshing a checkboxradio with an HTML-like initial text label Solution: Install the latest version. If you use the jQuery UI Checkboxradio module for Drupal 9, upgrade to: * jQuery UI Checkboxradio 8.x-1.4. [3] Reported By: * Benji Fisher [4], provisional member of the Drupal Security Team Fixed By: * Benji Fisher [5], provisional member of the Drupal Security Team * xjm [6] of the Drupal Security Team * Lauri Eskola [7], provisional member of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team Coordinated By: * xjm [9] of the Drupal Security Team [1] https://www.drupal.org/project/jquery_ui_checkboxradio [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/jquery_ui_checkboxradio/releases/8.x-1.4 [4] https://www.drupal.org/user/683300 [5] https://www.drupal.org/user/683300 [6] https://www.drupal.org/user/65776 [7] https://www.drupal.org/user/1078742 [8] https://www.drupal.org/user/36762 [9] https://www.drupal.org/user/65776

1 0