June 2023 - Security-news - lists.drupal.org

TacJS - Moderately critical - Cross site scripting - SA-CONTRIB-2023-029
by security-news＠drupal.org 28 Jun '23

28 Jun '23

View online: https://www.drupal.org/sa-contrib-2023-029 Project: TacJS [1] Date: 2023-June-28 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Description: This module enables sites to comply with the European cookie law using tarteaucitron.js. The module doesn't sufficiently filter user-supplied text leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker needs additional permissions. The vulnerability can be exploited by an attacker with a role with the permission "administer tacjs" regardless of other configurations. Solution: Install the latest version: * If you use the tacjs alert module, upgrade to tacjs 8.x-6.4 [3] Reported By: * Pierre Rudloff [4] Fixed By: * Amine Boulaffas [5] * Frank Mably [6] Coordinated By: * Damien McKenna [7] of the Drupal Security Team * Cathy Theys [8] of the Drupal Security Team * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/tacjs [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/tacjs/releases/8.x-6.4 [4] https://www.drupal.org/user/3611858 [5] https://www.drupal.org/user/3584750 [6] https://www.drupal.org/user/3375160 [7] https://www.drupal.org/user/108450 [8] https://www.drupal.org/user/258568 [9] https://www.drupal.org/user/36762

1 0

Expandable Formatter - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-028
by security-news＠drupal.org 28 Jun '23

28 Jun '23

View online: https://www.drupal.org/sa-contrib-2023-028 Project: Expandable Formatter [1] Version: 8.x-1.38.x-1.28.x-1.18.x-1.0 Date: 2023-June-28 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: This module enables you to render a field in an expandable/collapsible region. The module doesn't sufficiently sanitize the field content when displaying it to an end user. This vulnerability is mitigated by the fact that an attacker must have a role capable of creating content that uses the field formatter. Solution: Install the latest version: * If you use the Expandable Formatter module for Drupal 8.x, upgrade to Expandable Formatter 8.x-1.4 [3] Reported By: * Mariusz Andrzejewski [4] * Mitch Portier [5] Fixed By: * cilefen [6] of the Drupal Security Team * Kevin Dutra [7] * Mariusz Andrzejewski [8] * Mitch Portier [9] Coordinated By: * Damien McKenna [10] of the Drupal Security Team * Greg Knaddison [11] of the Drupal Security Team * cilefen [12] of the Drupal Security Team [1] https://www.drupal.org/project/expandable_formatter [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/expandable_formatter/releases/8.x-1.4 [4] https://www.drupal.org/user/3517832 [5] https://www.drupal.org/user/2284182 [6] https://www.drupal.org/user/1850070 [7] https://www.drupal.org/user/1312744 [8] https://www.drupal.org/user/3517832 [9] https://www.drupal.org/user/2284182 [10] https://www.drupal.org/user/108450 [11] https://www.drupal.org/user/36762 [12] https://www.drupal.org/user/1850070

1 0

Libraries UI - Moderately critical - Access bypass - SA-CONTRIB-2023-027
by security-news＠drupal.org 28 Jun '23

28 Jun '23

View online: https://www.drupal.org/sa-contrib-2023-027 Project: Libraries UI [1] Version: 8.x-1.0 Date: 2023-June-28 Security risk: *Moderately critical* 11∕25 AC:None/A:None/CI:None/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Description: This module enables a UI to display all libraries provided by modules and themes on the Drupal site. The module doesn't sufficiently protect the libraries reporting page. It curently is using the 'access content' permission and not a proper administrative/access permission. The vulnerability/library information can be exploited by simply visiting/knowing the url of the reporting page. The solution is to protect the page via a module specific permission that must be granted by an administrative user. Solution: Install the latest version of 8.x-1.x or upgrade to 8.x-2.x: * If you use the Libraries UI module 8.x-1.0, upgrade to Libraries UI 8.x-1.1 [3] * The vulnerability does not affect the Libraries UI module 8.x-2.x series. Reported By: * Jörg Riemenschneider [4] Fixed By: * Jörg Riemenschneider [5] * George [6] Coordinated By: * Damien McKenna [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/libraries_ui [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/libraries_ui/releases/8.x-1.1 [4] https://www.drupal.org/user/2809357 [5] https://www.drupal.org/user/2809357 [6] https://www.drupal.org/user/1270728 [7] https://www.drupal.org/user/108450 [8] https://www.drupal.org/user/36762

1 0

Search Autocomplete - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-026
by security-news＠drupal.org 28 Jun '23

28 Jun '23

View online: https://www.drupal.org/sa-contrib-2023-026 Project: Search Autocomplete [1] Date: 2023-June-28 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Affected versions: >=2.0.0 <2.0.3 Description: This module enables you to use complex autocompletion in forms. The module doesn't sufficiently filter text in the data it exposes, allowing a malicious user to enter specially crafted tags to exploit a Cross Site Scripting (XSS) attack. This vulnerability is mitigated by the fact that an attacker must have a role which allows them to publish the kind of data used in the autocomplete (for instance create nodes if the tool is used to search nodes, comments if the tool is used to search comments, etc...) Solution: Install the latest version: * If you use the search_autocomplete module for Drupal 8.x or 9.x, upgrade to Search Autocomplete 2.0.3 [3] Reported By: * Mingsong [4] Fixed By: * Mingsong [5] * Dominique CLAUSE [6] * Greg Knaddison [7] of the Drupal Security Team * Drew Webber [8] of the Drupal Security Team Coordinated By: * Damien McKenna [9] of the Drupal Security Team * Drew Webber [10] of the Drupal Security Team * Greg Knaddison [11] of the Drupal Security Team [1] https://www.drupal.org/project/search_autocomplete [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/search_autocomplete/releases/2.0.3 [4] https://www.drupal.org/user/2986445 [5] https://www.drupal.org/user/2986445 [6] https://www.drupal.org/user/801982 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/255969 [9] https://www.drupal.org/user/108450 [10] https://www.drupal.org/user/255969 [11] https://www.drupal.org/user/36762

1 0

Mailchimp - Critical - Cross Site Request Forgery - SA-CONTRIB-2023-025
by security-news＠drupal.org 28 Jun '23

28 Jun '23

View online: https://www.drupal.org/sa-contrib-2023-025 Project: Mailchimp [1] Date: 2023-June-28 Security risk: *Critical* 15∕25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Request Forgery Affected versions: >=2.2.0 <2.2.2 Description: This module provides integration with Mailchimp, a popular email delivery service. A route related to OAuth authentication is not protected against a Cross Site Request Forgery attack. Solution: Install the latest version: * If you use the mailchimp module for Drupal 8.x, upgrade to mailchimp 2.2.2 [3] Reported By: * Heine [4] of the Drupal Security Team Fixed By: * Olivier Bouwman [5] * Andy Price [6] * Maria Fisher [7] Coordinated By: * Heine [8] of the Drupal Security Team * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/mailchimp [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/mailchimp/releases/2.2.2 [4] https://www.drupal.org/user/17943 [5] https://www.drupal.org/user/2799483 [6] https://www.drupal.org/user/369147 [7] https://www.drupal.org/user/2210776 [8] https://www.drupal.org/user/17943 [9] https://www.drupal.org/user/36762

1 0

GridStack - Less critical - Cross Site Scripting - SA-CONTRIB-2023-024
by security-news＠drupal.org 28 Jun '23

28 Jun '23

View online: https://www.drupal.org/sa-contrib-2023-024 Project: GridStack [1] Version: 8.x-2.108.x-2.98.x-2.88.x-2.78.x-2.68.x-2.58.x-2.48.x-2.38.x-2.28.x-2.18.x-2.0 Date: 2023-June-28 Security risk: *Less critical* 7∕25 AC:Complex/A:Admin/CI:None/II:None/E:Exploit/TD:Uncommon [2] Vulnerability: Cross Site Scripting Description: This module enables you to create dynamic layouts and add sample color palettes for color selection hints via its UI. The module doesn't sufficiently sanitize the module's settings in certain scenarios leading to a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permissions "administer gridstack". Solution: Install the latest version: * If you use the GridStack module prior to version 8.x-2.11 for Drupal 9.x or 10.x, upgrade to GridStack 8.x-2.11 [3] Reported By: * Mitch Portier [4] Fixed By: * Gaus Surahman [5] * Mitch Portier [6] Coordinated By: * Damien McKenna [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/gridstack [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/gridstack/releases/8.x-2.11 [4] https://www.drupal.org/user/2284182 [5] https://www.drupal.org/user/159062 [6] https://www.drupal.org/user/2284182 [7] https://www.drupal.org/user/108450 [8] https://www.drupal.org/user/36762

1 0

GDPR Alert - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-023
by security-news＠drupal.org 28 Jun '23

28 Jun '23

View online: https://www.drupal.org/sa-contrib-2023-023 Project: GDPR Alert [1] Version: 1.0.0 Date: 2023-June-28 Security risk: *Moderately critical* 11∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross Site Scripting Affected versions: >=1.0 <1.0.1 Description: This module enables you to define configurable GDPR alert messages. The module doesn't sufficiently filter user-supplied text leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker needs additional permissions. The vulnerability can be exploited by an attacker with a role with the permission "administer gdpr alert" regardless of other configurations. Solution: Install the latest version: * If you use the GDPR alert module 1.0.0, upgrade to GDPR alert 1.0.1 [3] Reported By: * Mitch Portier [4] Fixed By: * George [5] * Mitch Portier [6] Coordinated By: * Damien McKenna [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/gdpr_alert [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/gdpr_alert/releases/1.0.1 [4] https://www.drupal.org/user/2284182 [5] https://www.drupal.org/user/1270728 [6] https://www.drupal.org/user/2284182 [7] https://www.drupal.org/user/108450 [8] https://www.drupal.org/user/36762

1 0

Civic Cookie Control - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-021
by security-news＠drupal.org 21 Jun '23

21 Jun '23

View online: https://www.drupal.org/sa-contrib-2023-021 Project: Civic Cookie Control [1] Date: 2023-June-21 Security risk: *Moderately critical* 11∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross Site Scripting Description: CivicCookieControl is a module that can help make a website compliant with EU and UK cookie legislation. The Civic GovUK Cookie Control module does not sufficiently sanitize the configuration resulting in a Cross-Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that the attacker must have a role with the "Administer Civic Cookie Control" permission. Solution: Install the latest version: * If you use the Civic Cookie Control module for Drupal 9.x, upgrade to Civic Cookie Control 4.4.13 [3] Reported By: * Mitch Portier [4] Fixed By: * Thanassis Perperis [5] * Mitch Portier [6] Coordinated By: * Damien McKenna [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/civicccookiecontrol [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/civicccookiecontrol/releases/4.4.13 [4] https://www.drupal.org/user/2284182 [5] https://www.drupal.org/user/2701781 [6] https://www.drupal.org/user/2284182 [7] https://www.drupal.org/user/108450 [8] https://www.drupal.org/user/36762

1 0

Album Photos - Critical - Access bypass - SA-CONTRIB-2023-022
by security-news＠drupal.org 21 Jun '23

21 Jun '23

View online: https://www.drupal.org/sa-contrib-2023-022 Project: Album Photos [1] Date: 2023-June-21 Security risk: *Critical* 15∕25 AC:None/A:Admin/CI:All/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Description: This module enables you to create and manage photos and photo albums on your website. The module doesn't sufficiently check node access when a user is provided the "edit any photo" or "delete any photo" permissions. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "edit any photo" or "delete any photo". Solution: Install the latest version: * If you use the 6.0.x version of the photos module for Drupal 9 or 10, upgrade to photos 6.0.4 [3] * If you use the 8.x version of the photos module for Drupal 9, upgrade to photos 8.x-4.5 [4] Reported By: * Marco Bouwer [5] Fixed By: * Nathaniel Burnett [6] * Marco Bouwer [7] Coordinated By: * Chris McCafferty [8] of the Drupal Security Team * Damien McKenna [9] of the Drupal Security Team * Greg Knaddison [10] of the Drupal Security Team [1] https://www.drupal.org/project/photos [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/photos/releases/6.0.4 [4] https://www.drupal.org/project/photos/releases/8.x-4.5 [5] https://www.drupal.org/user/1443348 [6] https://www.drupal.org/user/443482 [7] https://www.drupal.org/user/1443348 [8] https://www.drupal.org/user/1850070 [9] https://www.drupal.org/user/108450 [10] https://www.drupal.org/user/36762

1 0

Office Hours - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-020
by security-news＠drupal.org 14 Jun '23

14 Jun '23

View online: https://www.drupal.org/sa-contrib-2023-020 Project: Office Hours [1] Version: 8.x-1.58.x-1.48.x-1.38.x-1.28.x-1.18.x-1.0 Date: 2023-June-14 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: This module enables you to define a 'weekly office hours' field type, and add a field to any Content type, in order to display the weekly opening hours for a location. The module doesn't sufficiently filter user-supplied text leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker needs additional permissions. The vulnerability can be exploited by an attacker with a role with the permission "administer display" regardless of other configurations. In some scenarios, the vulnerability can be exploited by a user with "Create content" or "Edit content" for a relevant Content type. Solution: Install the latest version: * If you use the 'Office hours' module for Drupal 8.x, upgrade to office_hours 8.x-1.11 [3] Reported By: * John Voskuilen [4] * Mitch Portier [5] Fixed By: * John Voskuilen [6] * Mitch Portier [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/office_hours [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/office_hours/releases/8.x-1.11 [4] https://www.drupal.org/user/591042 [5] https://www.drupal.org/user/2284182 [6] https://www.drupal.org/user/591042 [7] https://www.drupal.org/user/2284182 [8] https://www.drupal.org/user/36762

1 0