March 2023 - Security-news - lists.drupal.org

Xray Audit - Moderately critical - Cross site scripting - SA-CONTRIB-2023-012
by security-news＠drupal.org 29 Mar '23

29 Mar '23

View online: https://www.drupal.org/sa-contrib-2023-012 Project: Xray Audit [1] Date: 2023-March-29 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Description: This module is a tool for developers, analysts, and administrators that allows them to generate reports on a given Drupal installation. The module does not sufficiently sanitize some data presented in its reports. This vulnerability is mitigated by the fact that an attacker must have a role with permissions to administer an impacted content type. Solution: Install the latest version: * If you use the Xray Audit module for Drupal 9.x / 10.x, upgrade to Xray Audit v.1.1.1 [3] Reported By: * Conrad Lara [4] Fixed By: * Luis Peidró [5] Coordinated By: * Damien McKenna [6] of the Drupal Security Team * Greg Knaddison [7] of the Drupal Security Team * Chris McCafferty [8] of the Drupal Security Team [1] https://www.drupal.org/project/xray_audit [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/xray_audit/releases/1.1.1 [4] https://www.drupal.org/user/1790054 [5] https://www.drupal.org/user/3372326 [6] https://www.drupal.org/user/108450 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/1850070

1 0

Responsive media Image Formatter - Critical - Unsupported - SA-CONTRIB-2023-011
by security-news＠drupal.org 15 Mar '23

15 Mar '23

View online: https://www.drupal.org/sa-contrib-2023-011 Project: Responsive media Image Formatter [1] Date: 2023-March-15 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/responsive_media_image [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Media Responsive Thumbnail - Moderately critical - Information disclosure - SA-CONTRIB-2023-010
by security-news＠drupal.org 15 Mar '23

15 Mar '23

View online: https://www.drupal.org/sa-contrib-2023-010 Project: Media Responsive Thumbnail [1] Date: 2023-March-15 Security risk: *Moderately critical* 14∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Information disclosure Description: The Media Responsive Thumbnail module allows media reference fields to be rendered as a responsive image. This module does not properly check entity access prior to rendering media. This may result in users seeing thumbnails of media items they do not have access to. This release was coordinated with SA-CORE-2023-002 [3]. Solution: Install the latest version: * If you use the Media Responsive Thumbnail module, upgrade to Media Responsive Thumbnail 8.x-1.5 [4] Reported By: * Dan Flanagan [5] Fixed By: * Ivan Vidusenko [6] * Benji Fisher [7] of the Drupal Security Team Coordinated By: * Benji Fisher [8] of the Drupal Security Team * Lee Rowlands [9] of the Drupal Security Team * Joseph Zhao [10] Provisional Member of the Drupal Security Team * Greg Knaddison [11] of the Drupal Security Team * Dave Long [12] of the Drupal Security Team [1] https://www.drupal.org/project/media_responsive_thumbnail [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/sa-core-2023-002 [4] https://www.drupal.org/project/media_responsive_thumbnail/releases/8.x-1.5 [5] https://www.drupal.org/user/3615359 [6] https://www.drupal.org/user/2989799 [7] https://www.drupal.org/user/683300 [8] https://www.drupal.org/user/683300 [9] https://www.drupal.org/user/395439 [10] https://www.drupal.org/user/1987218 [11] https://www.drupal.org/user/36762 [12] https://www.drupal.org/user/246492

1 0

Drupal core - Moderately critical - Access bypass - SA-CORE-2023-004
by security-news＠drupal.org 15 Mar '23

15 Mar '23

View online: https://www.drupal.org/sa-core-2023-004 Project: Drupal core [1] Date: 2023-March-15 Security risk: *Moderately critical* 14∕25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <7.95 || >=8.0.0 <9.4.12 || >=9.5.0 <9.5.5 || >=10.0.0 <10.0.5 Description: Drupal core provides a page that outputs the markup from phpinfo() to assist with diagnosing PHP configuration. If an attacker was able to achieve an XSS exploit against a privileged user, they may be able to use the phpinfo page to access sensitive information that could be used to escalate the attack. This vulnerability is mitigated by the fact that a successful XSS exploit is required in order to exploit it. Solution: Install the latest version: * If you are using Drupal 10.0, update to Drupal 10.0.5 [3]. * If you are using Drupal 9.5, update to Drupal 9.5.5 [4]. * If you are using Drupal 9.4, update to Drupal 9.4.12 [5]. * If you are using Drupal 7, update to Drupal 7.95 [6]. All versions of Drupal 9 prior to 9.4.x are end-of-life and do not receive security coverage. Note that Drupal 8 has reached its end of life [7]. Reported By: * Elar Lang [8] Fixed By: * Damien McKenna [9] of the Drupal Security Team * Elar Lang [10] * Lee Rowlands [11] of the Drupal Security Team * Alex Bronstein [12] of the Drupal Security Team * Joseph Zhao [13] Provisional Member of the Drupal Security Team * Drew Webber [14] of the Drupal Security Team * Jen Lampton [15] Provisional Member of the Drupal Security Team * Nate Lampton [16] * Greg Knaddison [17] of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/drupal/releases/10.0.5 [4] https://www.drupal.org/project/drupal/releases/9.5.5 [5] https://www.drupal.org/project/drupal/releases/9.4.12 [6] https://www.drupal.org/project/drupal/releases/7.95 [7] https://www.drupal.org/psa-2021-06-29 [8] https://www.drupal.org/user/3583903 [9] https://www.drupal.org/user/108450 [10] https://www.drupal.org/user/3583903 [11] https://www.drupal.org/user/395439 [12] https://www.drupal.org/user/78040 [13] https://www.drupal.org/user/1987218 [14] https://www.drupal.org/user/255969 [15] https://www.drupal.org/user/85586 [16] https://www.drupal.org/user/35821 [17] https://www.drupal.org/user/36762

1 0

Drupal core - Moderately critical - Information Disclosure - SA-CORE-2023-003
by security-news＠drupal.org 15 Mar '23

15 Mar '23

View online: https://www.drupal.org/sa-core-2023-003 Project: Drupal core [1] Date: 2023-March-15 Security risk: *Moderately critical* 13∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Information Disclosure Affected versions: >=8.0.0 <9.4.12 || >=9.5.0 <9.5.5 || >=10.0.0 <10.0.5 Description: The language module provides a Language switcher block which can be placed to provide links to quickly switch between different languages. The URL of unpublished translations may be disclosed. When used in conjunction with a module like Pathauto, this may reveal the title of unpublished content. This advisory is not covered by Drupal Steward [3]. Solution: Install the latest version: * If you are using Drupal 10.0, update to Drupal 10.0.5 [4]. * If you are using Drupal 9.5, update to Drupal 9.5.5 [5]. * If you are using Drupal 9.4, update to Drupal 9.4.12 [6]. All versions of Drupal 9 prior to 9.4.x are end-of-life and do not receive security coverage. Note that Drupal 8 has reached its end of life [7]. Drupal 7 core does not include the Language module and therefore is not affected. The contributed modules for translation do not have the same code for language-switching links, so they are not affected, either. Reported By: * Jan Kellermann [8] Fixed By: * Jan Kellermann [9] * Lee Rowlands [10] of the Drupal Security Team * Greg Knaddison [11] of the Drupal Security Team * Benji Fisher [12] of the Drupal Security Team * Jess [13] of the Drupal Security Team * Sascha Grossenbacher [14] * Neil Drumm [15] of the Drupal Security Team * Dave Long [16] of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/steward [4] https://www.drupal.org/project/drupal/releases/10.0.5 [5] https://www.drupal.org/project/drupal/releases/9.5.5 [6] https://www.drupal.org/project/drupal/releases/9.4.12 [7] https://www.drupal.org/psa-2021-06-29 [8] https://www.drupal.org/user/371731 [9] https://www.drupal.org/user/371731 [10] https://www.drupal.org/user/395439 [11] https://www.drupal.org/user/36762 [12] https://www.drupal.org/user/683300 [13] https://www.drupal.org/user/65776 [14] https://www.drupal.org/user/214652 [15] https://www.drupal.org/user/3064 [16] https://www.drupal.org/user/246492

1 0

Drupal core - Moderately critical - Information Disclosure - SA-CORE-2023-002
by security-news＠drupal.org 15 Mar '23

15 Mar '23

View online: https://www.drupal.org/sa-core-2023-002 Project: Drupal core [1] Date: 2023-March-15 Security risk: *Moderately critical* 14∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Information Disclosure Affected versions: >=8.0.0 <9.4.12 || >=9.5.0 <9.5.5 || >=10.0.0 <10.0.5 Description: The Media module does not properly check entity access in some circumstances. This may result in users seeing thumbnails of media items they do not have access to, including for private files. This release was coordinated with SA-CONTRIB-2023-010 [3]. This advisory is not covered by Drupal Steward [4]. Solution: Install the latest version: * If you are using Drupal 10.0, update to Drupal 10.0.5 [5]. * If you are using Drupal 9.5, update to Drupal 9.5.5 [6]. * If you are using Drupal 9.4, update to Drupal 9.4.12 [7]. All versions of Drupal 9 prior to 9.4.x are end-of-life and do not receive security coverage. Note that Drupal 8 has reached its end of life [8]. Drupal 7 core does not include the Media Library module and therefore is not affected. Reported By: * James Williams [9] * Dan Flanagan [10] Fixed By: * Lee Rowlands [11] of the Drupal Security Team * James Williams [12] * Jess [13] of the Drupal Security Team * Dave Long [14] of the Drupal Security Team * Dan Flanagan [15] * Jen Lampton [16] Provisional Member of the Drupal Security Team * Joseph Zhao [17] Provisional Member of the Drupal Security Team * Benji Fisher [18] of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/sa-contrib-2023-010 [4] https://www.drupal.org/steward [5] https://www.drupal.org/project/drupal/releases/10.0.5 [6] https://www.drupal.org/project/drupal/releases/9.5.5 [7] https://www.drupal.org/project/drupal/releases/9.4.12 [8] https://www.drupal.org/psa-2021-06-29 [9] https://www.drupal.org/user/592268 [10] https://www.drupal.org/user/3615359 [11] https://www.drupal.org/user/395439 [12] https://www.drupal.org/user/592268 [13] https://www.drupal.org/user/65776 [14] https://www.drupal.org/user/246492 [15] https://www.drupal.org/user/3615359 [16] https://www.drupal.org/user/85586 [17] https://www.drupal.org/user/1987218 [18] https://www.drupal.org/user/683300

1 0

Gutenberg - Less critical - Denial of Service - SA-CONTRIB-2023-009
by security-news＠drupal.org 08 Mar '23

08 Mar '23

View online: https://www.drupal.org/sa-contrib-2023-009 Project: Gutenberg [1] Date: 2023-March-08 Security risk: *Less critical* 8∕25 AC:Basic/A:User/CI:None/II:None/E:Theoretical/TD:All [2] Vulnerability: Denial of Service Description: This module provides a new UI experience for node editing - Gutenberg editor. This vulnerability can cause DoS by using reusable blocks improperly. This vulnerability is mitigated by the fact an attacker must have "use gutenberg" permission to exploit it. Solution: Install the latest version: * If you use the Gutenberg module versions 8.x-2.x, upgrade to Gutenberg 8.x-2.7 [3] Reported By: * Eirik Morland [4] Fixed By: * Eirik Morland [5] * Marco Fernandes [6] * Stephan Zeidler [7] Coordinated By: * Damien McKenna [8] of the Drupal Security Team * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/gutenberg [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/gutenberg/releases/8.x-2.7 [4] https://www.drupal.org/user/1014468 [5] https://www.drupal.org/user/1014468 [6] https://www.drupal.org/user/2127558 [7] https://www.drupal.org/user/767652 [8] https://www.drupal.org/user/108450 [9] https://www.drupal.org/user/36762

1 0

Group control for forums - Critical - Access bypass - SA-CONTRIB-2023-008
by security-news＠drupal.org 01 Mar '23

01 Mar '23

View online: https://www.drupal.org/sa-contrib-2023-008 Project: Group control for forums [1] Date: 2023-March-01 Security risk: *Critical* 15∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: >=2.0.0 <2.0.2 Description: This module enables you to associate Forums as Group 1.x content and use Group access permissions. Previous versions of the module incorrectly set node access on creation, and did not correctly restrict access to lists of forum topics. Solution: Install the latest version: * If you use the Group control for forums module for Drupal 9.x or 10.x, upgrade to Group control for forums 2.0.2 [3] Reported By: * ekes [4] Fixed By: * Jürgen Haas [5] * ekes [6] Coordinated By: * Damien McKenna [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/group_forum [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/group_forum/releases/2.0.2 [4] https://www.drupal.org/user/10083 [5] https://www.drupal.org/user/168924 [6] https://www.drupal.org/user/10083 [7] https://www.drupal.org/user/108450 [8] https://www.drupal.org/user/36762

1 0

Thunder - Moderately critical - Access bypass - SA-CONTRIB-2023-007
by security-news＠drupal.org 01 Mar '23

01 Mar '23

View online: https://www.drupal.org/sa-contrib-2023-007 Project: Thunder [1] Date: 2023-March-01 Security risk: *Moderately critical* 13∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: >=6.4.0 <6.4.6 || >=6.5.0 <6.5.3 Description: Thunder is a Drupal distribution for professional publishing. The thunder distribution ships the thunder_gqls module which provides a graphql interface. The module doesn't sufficiently check access when serving user data via graphql leading to an access bypass vulnerability potentially exposing email addresses. Solution: Install the latest version: * If you use the thunder distribution for Drupal 9.x and have the thunder_gqls module enabled, upgrade to thunder 6.4.6 [3] or thunder 6.5.3 [4] respectively. Reported By: * Steffen Schlaer [5] Fixed By: * Volker Killesreiter [6] * Alexander Varwijk [7] * Steffen Schlaer [8] * Klaus Purer [9] * Daniel Bosen [10] Coordinated By: * Greg Knaddison [11] of the Drupal Security Team [1] https://www.drupal.org/project/thunder [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/thunder/releases/6.4.6 [4] https://www.drupal.org/project/thunder/releases/6.5.3 [5] https://www.drupal.org/user/324945 [6] https://www.drupal.org/user/57527 [7] https://www.drupal.org/user/1868952 [8] https://www.drupal.org/user/324945 [9] https://www.drupal.org/user/262198 [10] https://www.drupal.org/user/404865 [11] https://www.drupal.org/user/36762

1 0

Better Social Sharing Buttons - Less critical - Cross Site Scripting - SA-CONTRIB-2023-006
by security-news＠drupal.org 01 Mar '23

01 Mar '23

View online: https://www.drupal.org/sa-contrib-2023-006 Project: Better Social Sharing Buttons [1] Date: 2023-March-01 Security risk: *Less critical* 8∕25 AC:Basic/A:User/CI:None/II:None/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: This module enables you to add social sharing buttons to a site. The module doesn't sufficiently sanitize the weight and ratio values entered in the module or block configuration. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer blocks". Solution: Install the latest version: * If you use the Better Social Sharing Buttons module for Drupal 9 or 10, upgrade to Better Social Sharing Buttons 4.0.3 [3] Reported By: * cydave [4] Fixed By: * cydave [5] * Shelane French [6] Coordinated By: * Damien McKenna [7] of the Drupal Security Team [1] https://www.drupal.org/project/better_social_sharing_buttons [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/better_social_sharing_buttons/releases/4.0.3 [4] https://www.drupal.org/user/3751740 [5] https://www.drupal.org/user/3751740 [6] https://www.drupal.org/user/2674989 [7] https://www.drupal.org/user/108450

1 0