May 2023 - Security-news - lists.drupal.org

AddToAny Share Buttons - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-019
by security-news＠drupal.org 31 May '23

31 May '23

View online: https://www.drupal.org/sa-contrib-2023-019 Project: AddToAny Share Buttons [1] Date: 2023-May-31 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: This module provides social media share & follow buttons. The module doesn't sufficiently restrict AddToAny block settings to users who have permission to administer AddToAny. This allows users with lower permission to configure malicious code leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer blocks". Solution: Install the latest version: * If you use the AddToAny Share Buttons module for Drupal 9.4+ or 10, upgrade to AddToAny 2.0.4 [3] * If you use the AddToAny Share Buttons module for Drupal versions before 9.4, upgrade to AddToAny 8.x-1.21 [4] Reported By: * Mitch Portier [5] Fixed By: * micropat [6] * Vladimir Roudakov [7] * Mitch Portier [8] Coordinated By: * Damien McKenna [9] of the Drupal Security Team [1] https://www.drupal.org/project/addtoany [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/addtoany/releases/2.0.4 [4] https://www.drupal.org/project/addtoany/releases/8.x-1.21 [5] https://www.drupal.org/user/2284182 [6] https://www.drupal.org/user/260224 [7] https://www.drupal.org/user/673120 [8] https://www.drupal.org/user/2284182 [9] https://www.drupal.org/user/108450

1 0

AddToAny Share Buttons - Moderately critical - Access bypass - SA-CONTRIB-2023-018
by security-news＠drupal.org 31 May '23

31 May '23

View online: https://www.drupal.org/sa-contrib-2023-018 Project: AddToAny Share Buttons [1] Date: 2023-May-31 Security risk: *Moderately critical* 11∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Description: This module provides social media share & follow buttons. The module doesn't sufficiently check access to a node when retrieving the label of an AddToAny block. This vulnerability is mitigated by the fact it requires the node ID to be passed via the route, requiring another module or specific configuration to provide this ID, as the /node/{id} page doesn't provide this value on an access denied. Solution: Install the latest version: * If you use the AddToAny Share Buttons module for Drupal 9.4+ or 10, upgrade to AddToAny 2.0.4 [3] * If you use the AddToAny Share Buttons module for Drupal versions before 9.4, upgrade to AddToAny 8.x-1.21 [4] Reported By: * Mitch Portier [5] Fixed By: * Vladimir Roudakov [6] * micropat [7] * Mitch Portier [8] Coordinated By: * Damien McKenna [9] of the Drupal Security Team [1] https://www.drupal.org/project/addtoany [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/addtoany/releases/2.0.4 [4] https://www.drupal.org/project/addtoany/releases/8.x-1.21 [5] https://www.drupal.org/user/2284182 [6] https://www.drupal.org/user/673120 [7] https://www.drupal.org/user/260224 [8] https://www.drupal.org/user/2284182 [9] https://www.drupal.org/user/108450

1 0

Consent Popup - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-017
by security-news＠drupal.org 31 May '23

31 May '23

View online: https://www.drupal.org/sa-contrib-2023-017 Project: Consent Popup [1] Date: 2023-May-31 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: The Consent Popup provides a configurable popup that requires acceptance of a question before the visitor can continue, typically used for age consent. The module doesn't sufficiently sanitizes the text on the block leading to a cross site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create blocks. Solution: Install the latest version: * Upgrade to Consent Popup 1.0.3 [3] Reported By: * Mitch Portier [4] Fixed By: * Paulo Calado [5] * Mitch Portier [6] Coordinated By: * Damien McKenna [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/consent_popup [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/consent_popup/releases/1.0.3 [4] https://www.drupal.org/user/2284182 [5] https://www.drupal.org/user/3533061 [6] https://www.drupal.org/user/2284182 [7] https://www.drupal.org/user/108450 [8] https://www.drupal.org/user/36762

1 0

Iubenda Integration - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-016
by security-news＠drupal.org 31 May '23

31 May '23

View online: https://www.drupal.org/sa-contrib-2023-016 Project: Iubenda Integration [1] Date: 2023-May-31 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: The Iubenda Integration module provides a custom block to provide a link to the Iubenda privacy policy. On this block, a custom prefix and suffix text can be entered. The module does not sufficiently filter the block text fields on output, resulting in a Cross-Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to use the layout builder on content, edit the layout, or with the "Administer blocks" permission. Solution: Install the latest version: * If you use the Iubenda Integration module for Drupal 9+, upgrade to Iubenda Integration 4.0.1 [3] * If you use the Iubenda Integration module for Drupal 7, upgrade to Iubenda Integration 7.x-2.5 [4] Reported By: * Mitch Portier [5] Fixed By: * Roberto Peruzzo [6] * Mitch Portier [7] Coordinated By: * Damien McKenna [8] of the Drupal Security Team * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/iubenda_integration [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/iubenda_integration/releases/4.0.1 [4] https://www.drupal.org/project/iubenda_integration/releases/7.x-2.5 [5] https://www.drupal.org/user/2284182 [6] https://www.drupal.org/user/2661375 [7] https://www.drupal.org/user/2284182 [8] https://www.drupal.org/user/108450 [9] https://www.drupal.org/user/36762

1 0

File Chooser Field - Moderately critical - Server Side Request Forgery, Information Disclosure - SA-CONTRIB-2023-015
by security-news＠drupal.org 17 May '23

17 May '23

View online: https://www.drupal.org/sa-contrib-2023-015 Project: File Chooser Field [1] Date: 2023-May-17 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:None/E:Exploit/TD:All [2] Vulnerability: Server Side Request Forgery, Information Disclosure Description: The File Chooser Field allows users to upload files using 3rd party plugins such as Google Drive and Dropbox. This module fails to validate user input sufficiently which could under certain circumstances lead to a Server Side Request Forgery (SSRF) vulnerability leading to Information Disclosure. In uncommon configurations and scenarios, it might lead to Remote Code Execution. Solution: * If you use File Chooser Field version 7.x-1.x, Upgrade to 7.x-1.13 [3] Reported By: * Drew Webber [4] of the Drupal Security Team * George Hazlewood [5] Fixed By: * Drew Webber [6] of the Drupal Security Team * aaron.ferris [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/file_chooser_field [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/file_chooser_field/releases/7.x-1.13 [4] https://www.drupal.org/user/255969 [5] https://www.drupal.org/user/2314 [6] https://www.drupal.org/user/255969 [7] https://www.drupal.org/user/1338234 [8] https://www.drupal.org/user/36762

1 0

S3 File System - Moderately critical - Access bypass - SA-CONTRIB-2023-014
by security-news＠drupal.org 03 May '23

03 May '23

View online: https://www.drupal.org/sa-contrib-2023-014 Project: S3 File System [1] Version: 8.x-3.18.x-3.08.x-3.0-rc28.x-3.0-rc18.x-3.0-beta78.x-3.0-beta68.x-3.0-beta58.x-3.0-beta48.x-3.0-beta38.x-3.0-beta28.x-3.0-beta18.x-3.0-alpha17 Date: 2023-May-03 Security risk: *Moderately critical* 13∕25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: S3 File System (s3fs) provides an additional file system to your Drupal site, which stores files in Amazon's Simple Storage Service (S3) or any other S3-compatible storage service. This module may fail to validate that a file being requested to be moved to storage was uploaded during the same web request, possibly allowing an attacker to move files that should normally be inaccessible to them. This vulnerability is mitigated by the fact that another vulnerability must already exist outside of s3fs. Solution: Install the latest version: * If you use the S3 File System module for Drupal 8.x, upgrade to s3fs 8.x-3.2 [3] Reported By: * Conrad Lara [4] Fixed By: * Conrad Lara [5] Coordinated By: * Greg Knaddison [6] of the Drupal Security Team [1] https://www.drupal.org/project/s3fs [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/s3fs/releases/8.x-3.2 [4] https://www.drupal.org/user/1790054 [5] https://www.drupal.org/user/1790054 [6] https://www.drupal.org/user/36762

1 0