August 2023 - Security-news - lists.drupal.org

Obfuscate Email - Less critical - Cross Site Scripting - SA-CONTRIB-2023-042
by security-news＠drupal.org 30 Aug '23

30 Aug '23

View online: https://www.drupal.org/sa-contrib-2023-042 Project: Obfuscate Email [1] Date: 2023-August-30 Security risk: *Less critical* 5∕25 AC:Complex/A:User/CI:None/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross Site Scripting Affected versions: <2.0.1 Description: This module enables you to hide email addresses from bots and site scrapers by using the rot13 strategy. The module doesn't sufficiently escape the data attribute under the scenario a user has access to manipulate that value. This vulnerability is mitigated by the fact that an attacker must have a role with permissions to allow data attributes in content on a site. Solution: Install the latest version: * If you use the Obfuscate Email module for Drupal 2.0.0, upgrade to Obfuscate Email 2.0.1 [3] Reported By: * Pierre Rudloff [4] Fixed By: * b_sharpe [5] * Pierre Rudloff [6] Coordinated By: * cilefen [7] of the Drupal Security Team * Damien McKenna [8] of the Drupal Security Team * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/obfuscate_email [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/obfuscate_email/releases/2.0.1 [4] https://www.drupal.org/user/3611858 [5] https://www.drupal.org/user/2512258 [6] https://www.drupal.org/user/3611858 [7] https://www.drupal.org/user/1850070 [8] https://www.drupal.org/user/108450 [9] https://www.drupal.org/user/36762

1 0

Unified Twig Extensions - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-041
by security-news＠drupal.org 30 Aug '23

30 Aug '23

View online: https://www.drupal.org/sa-contrib-2023-041 Project: Unified Twig Extensions [1] Date: 2023-August-30 Security risk: *Moderately critical* 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Scripting Affected versions: <1.1.1 Description: This module makes PatternLab's custom Twig functions available to Drupal theming. The module's included examples don't sufficiently filter data. This vulnerability is mitigated by the fact that the included examples must have been copied to a site's theme. Solution: Install the latest version: * If you use the Unified Twig Extensions module, upgrade to Unified Twig Extensions 1.1.1 [3] Reported By: * Pierre Rudloff [4] Fixed By: * Oleksandr Kuzava [5] * Pierre Rudloff [6] Coordinated By: * Damien McKenna [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/unified_twig_ext [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/unified_twig_ext/releases/1.1.1 [4] https://www.drupal.org/user/3611858 [5] https://www.drupal.org/user/2822325 [6] https://www.drupal.org/user/3611858 [7] https://www.drupal.org/user/108450 [8] https://www.drupal.org/user/36762

1 0

Config Pages - Moderately critical - Information Disclosure - SA-CONTRIB-2023-037
by security-news＠drupal.org 23 Aug '23

23 Aug '23

View online: https://www.drupal.org/sa-contrib-2023-037 Project: Config Pages [1] Version: 8.x-2.88.x-2.78.x-2.68.x-2.58.x-2.48.x-2.38.x-2.28.x-2.18.x-2.0 Date: 2023-August-23 Security risk: *Moderately critical* 12∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Information Disclosure Affected versions: <2.9.0 Description: This module enables you to build administrative pages for managing configuration objects, which may then be used elsewhere in the site. The module doesn't sufficiently validate access when the JSONAPI module is also installed. This vulnerability is mitigated by the fact that it only affects sites when the JSONAPI module is installed. Solution: Install the latest version: * If you use the Config Pages module for Drupal 8+, upgrade to Config Pages 8.x-2.9 [3] Reported By: * Nate Andersen [4] Fixed By: * Nate Andersen [5] * Alexander Shumenko [6] Coordinated By: * Damien McKenna [7] of the Drupal Security Team * Michael Hess [8] of the Drupal Security Team [1] https://www.drupal.org/project/config_pages [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/config_pages/releases/8.x-2.9 [4] https://www.drupal.org/user/471638 [5] https://www.drupal.org/user/471638 [6] https://www.drupal.org/user/2297432 [7] https://www.drupal.org/user/108450 [8] https://www.drupal.org/user/102818

1 0

Shorthand - Critical - Access bypass - SA-CONTRIB-2023-038
by security-news＠drupal.org 23 Aug '23

23 Aug '23

View online: https://www.drupal.org/sa-contrib-2023-038 Project: Shorthand [1] Version: 4.0.24.0.14.0.0 Date: 2023-August-23 Security risk: *Critical* 15∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <4.0.3 Description: This module provides integration with Shorthand, an application which describes itself as "beautifully simple storytelling". The module does not check appropriate permissions when displaying a list of all shorthand stories. Solution: Install the latest version: * If you use the Shorthand module for Drupal 8+, upgrade to Shorthand 4.0.3 [3] Reported By: * Paul Martin [4] Fixed By: * Vladimir Roudakov [5] Coordinated By: * Damien McKenna [6] of the Drupal Security Team * Dave Long [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/shorthand [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/shorthand/releases/4.0.3 [4] https://www.drupal.org/user/2221576 [5] https://www.drupal.org/user/673120 [6] https://www.drupal.org/user/108450 [7] https://www.drupal.org/user/246492 [8] https://www.drupal.org/user/36762

1 0

SafeDelete - Moderately critical - Access bypass - SA-CONTRIB-2023-039
by security-news＠drupal.org 23 Aug '23

23 Aug '23

View online: https://www.drupal.org/sa-contrib-2023-039 Project: SafeDelete [1] Version: 1.0.431.0.421.0.411.0.401.0.391.0.381.0.361.0.351.0.341.0.331.0.321.0.311.0.301.0.291.0.281.0.271.0.261.0.251.0.241.0.231.0.221.0.211.0.201.0.191.0.181.0.171.0.161.0.151.0.141.0.131.0.121.0.111.0.101.0.91.0.81.0.71.0.51.0.41.0.31.0.21.0.11.0.0 Date: 2023-August-23 Security risk: *Moderately critical* 13∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <1.0.44 Description: This module aims to prevent broken content references by informing content editors either on delete or archive moderation. The module provides an "orphaned content" report for broken references, which may reveal titles of unpublished content. Solution: Install the latest version: * If you use the SafeDelete module for Drupal 8/9 or 10, please upgrade to SafeDelete 1.0.44 [3] Reported By: * Christopher Hopper [4] Fixed By: * Joseph Olstad [5] * Cathy Theys [6] of the Drupal Security Team * James Yao [7] * Christopher Hopper [8] Coordinated By: * Cathy Theys [9] of the Drupal Security Team * Damien McKenna [10] of the Drupal Security Team * Greg Knaddison [11] of the Drupal Security Team [1] https://www.drupal.org/project/safedelete [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/safedelete/releases/1.0.44 [4] https://www.drupal.org/user/116649 [5] https://www.drupal.org/user/1321830 [6] https://www.drupal.org/user/258568 [7] https://www.drupal.org/user/3644558 [8] https://www.drupal.org/user/116649 [9] https://www.drupal.org/user/258568 [10] https://www.drupal.org/user/108450 [11] https://www.drupal.org/user/36762

1 0

Data field - Moderately critical - Access bypass - SA-CONTRIB-2023-040
by security-news＠drupal.org 23 Aug '23

23 Aug '23

View online: https://www.drupal.org/sa-contrib-2023-040 Project: Data field [1] Version: 1.0.151.0.141.0.131.0.121.0.111.0.101.0.91.0.81.0.71.0.61.0.51.0.41.0.31.0.21.0.11.0.0 Date: 2023-August-23 Security risk: *Moderately critical* 12∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <1.0.16 Description: The Data Field module provides a way of building field types that are made up of other fields, a simpler alternative to e.g. the Paragraphs system. Access to these forms isn't properly validated, allowing a user with the "access content" permission to view and edit fields on entities. Solution: Install the latest version: * If you use the Data Field module for Drupal 1.x, upgrade to Data Field 1.0.16 [3] Reported By: * Mitch Portier [4] Fixed By: * Mitch Portier [5] * Damien McKenna [6] of the Drupal Security Team * NGUYEN Bao [7] * Joseph Olstad [8] Coordinated By: * Damien McKenna [9] of the Drupal Security Team * Greg Knaddison [10] of the Drupal Security Team * Neil Drumm [11] of the Drupal Security Team * Stella Power [12] of the Drupal Security Team [1] https://www.drupal.org/project/datafield [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/datafield/releases/1.0.16 [4] https://www.drupal.org/user/2284182 [5] https://www.drupal.org/user/2284182 [6] https://www.drupal.org/user/108450 [7] https://www.drupal.org/user/2896581 [8] https://www.drupal.org/user/1321830 [9] https://www.drupal.org/user/108450 [10] https://www.drupal.org/user/36762 [11] https://www.drupal.org/user/3064 [12] https://www.drupal.org/user/66894

1 0

Flexi Access - Critical - Arbitrary PHP code execution - SA-CONTRIB-2023-036
by security-news＠drupal.org 23 Aug '23

23 Aug '23

View online: https://www.drupal.org/sa-contrib-2023-036 Project: Flexi Access [1] Date: 2023-August-23 Security risk: *Critical* 17∕25 AC:Basic/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Arbitrary PHP code execution Description: The Flexi Access module will provide a simple and flexible interface to the ACL (Access Control List) module. It will let you set up and mange ACLs naming individual users that are allowed access to a particular node. The module processes user input in a way that could be unsafe. This can lead to Remote Code Execution via Object Injection. This vulnerability is mitigated by the fact that known exploit paths require an attacker to have a combination of permissions provided by the module; for example "access flexiaccess" and "flexiaccess view". See _flexiaccess_node_access() for details. The "administer flexiaccess" permission alone does not grant access to the vulnerable functionality. This Security Advisory is being released in coordination with SA-CONTRIB-2023-034 [3] for the ACL module, on which Flexi Access depends. Solution: Install the latest version: * If you use the Flexi Access module for Drupal 7.x, upgrade to Flexi Access 7.x-1.3 [4]. The ACL module (a dependency) must also be updated. Reported By: * Drew Webber [5] of the Drupal Security Team Fixed By: * Drew Webber [6] of the Drupal Security Team * Gisle Hannemyr [7] Coordinated By: * Drew Webber [8] of the Drupal Security Team * Cathy Theys [9] of the Drupal Security Team * Damien McKenna [10] of the Drupal Security Team [1] https://www.drupal.org/project/flexiaccess [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/sa-contrib-2023-034 [4] https://www.drupal.org/project/flexiaccess/releases/7.x-1.3 [5] https://www.drupal.org/user/255969 [6] https://www.drupal.org/user/255969 [7] https://www.drupal.org/user/409554 [8] https://www.drupal.org/user/255969 [9] https://www.drupal.org/user/258568 [10] https://www.drupal.org/user/108450

1 0

Forum Access - Critical - Arbitrary PHP code execution - SA-CONTRIB-2023-035
by security-news＠drupal.org 23 Aug '23

23 Aug '23

View online: https://www.drupal.org/sa-contrib-2023-035 Project: Forum Access [1] Date: 2023-August-23 Security risk: *Critical* 17∕25 AC:Basic/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Arbitrary PHP code execution Affected versions: <1.0.0 Description: This module changes your forum administration page to allow you to set forums private. You can control what user roles can view, edit, delete, and post to each forum. You can also give each forum a list of users who have administrative access on that forum (AKA moderators). This module requires the ACL module. The module processes user input in a way that could be unsafe. This can lead to Remote Code Execution via Object Injection. This vulnerability is mitigated by the fact that an attacker needs the "administer forums" permission. This Security Advisory is being released in coordination with SA-CONTRIB-2023-034 [3] for the ACL module, on which Forum Access depends. Solution: Install the latest version: * If you use the Forum Access module for Drupal 7.x, upgrade to Forum Access 7.x-1.6 [4] * If you use the Forum Access module 8.x-1.0-beta3 or below, upgrade to Forum Access 8.x-1.0 [5] The ACL module (a dependency) must also be updated. Reported By: * Drew Webber [6] of the Drupal Security Team Fixed By: * Drew Webber [7] of the Drupal Security Team * Hans Salvisberg [8] * Jen Lampton [9] Provisional Member of the Drupal Security Team Coordinated By: * Drew Webber [10] of the Drupal Security Team * Damien McKenna [11] of the Drupal Security Team * Greg Knaddison [12] of the Drupal Security Team * Michael Hess [13] of the Drupal Security Team [1] https://www.drupal.org/project/forum_access [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/sa-contrib-2023-034 [4] https://www.drupal.org/project/forum_access/releases/7.x-1.6 [5] https://www.drupal.org/project/forum_access/releases/8.x-1.0 [6] https://www.drupal.org/user/255969 [7] https://www.drupal.org/user/255969 [8] https://www.drupal.org/user/82964 [9] https://www.drupal.org/user/85586 [10] https://www.drupal.org/user/255969 [11] https://www.drupal.org/user/108450 [12] https://www.drupal.org/user/36762 [13] https://www.drupal.org/user/102818

1 0

ACL - Critical - Arbitrary PHP code execution - SA-CONTRIB-2023-034
by security-news＠drupal.org 23 Aug '23

23 Aug '23

View online: https://www.drupal.org/sa-contrib-2023-034 Project: ACL [1] Date: 2023-August-23 Security risk: *Critical* 17∕25 AC:Basic/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Arbitrary PHP code execution Affected versions: <1.0.0 Description: The ACL module, short for Access Control Lists, is an API for other modules to create lists of users and give them access to nodes. The module processes user input in a way that could be unsafe. This can lead to Remote Code Execution via Object Injection. As this is an API module, it is only exploitable if a "client" module exposes the vulnerability. Details of some contributed client modules are given below. Custom modules using ACL could also expose the vulnerability. This vulnerability is mitigated by the fact that an attacker typically needs an "admin"-type permission provided by one of ACL's client modules. Known client modules include: * Forum Access * Flexi Access * Content Access Coordinated Security Advisories are being released for those client modules that have Security coverage. Solution: Install the latest version: * If you use the ACL module for Drupal 7.x, upgrade to ACL 7.x-1.4 [3] * If you use the ACL module 8.x-1.0-beta3 or below, upgrade to ACL 8.x-1.0 [4] Any client modules that depend on ACL should also be updated. Reported By: * Drew Webber [5] of the Drupal Security Team * Samuel Mortenson [6] Fixed By: * Drew Webber [7] of the Drupal Security Team * Hans Salvisberg [8] * Jen Lampton [9] Provisional Member of the Drupal Security Team * xeM8VfDh [10] Coordinated By: * Drew Webber [11] of the Drupal Security Team * Damien McKenna [12] of the Drupal Security Team * Greg Knaddison [13] of the Drupal Security Team * Michael Hess [14] of the Drupal Security Team [1] https://www.drupal.org/project/acl [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/acl/releases/7.x-1.4 [4] https://www.drupal.org/project/acl/releases/8.x-1.0 [5] https://www.drupal.org/user/255969 [6] https://www.drupal.org/user/2582268 [7] https://www.drupal.org/user/255969 [8] https://www.drupal.org/user/82964 [9] https://www.drupal.org/user/85586 [10] https://www.drupal.org/user/3446669 [11] https://www.drupal.org/user/255969 [12] https://www.drupal.org/user/108450 [13] https://www.drupal.org/user/36762 [14] https://www.drupal.org/user/102818

1 0

Matomo Analytics - Less critical - Cross Site Scripting - SA-CONTRIB-2023-033
by security-news＠drupal.org 02 Aug '23

02 Aug '23

View online: https://www.drupal.org/sa-contrib-2023-033 Project: Matomo Analytics [1] Date: 2023-August-02 Security risk: *Less critical* 8∕25 AC:Complex/A:Admin/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Scripting Affected versions: <1.22.0 Description: This module enables you to add the Matomo web statistics tracking system to your website. The module does not check the Matomo JS code loaded on the website. So a user could configure the module to load JS from a malicious website. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer matomo" or "administer matomo tag manager" (D8+ only) to access the settings forms where this can be configured. Solution: Install the latest version: * If you use the Matomo Analytics module for Drupal 7, upgrade to Matomo Analytics 7.x-2.15 [3] * If you use the Matomo Analytics module for Drupal 8, upgrade to Matomo Analytics 8.x-1.22 [4] Sites are encouraged to review which roles have that permission and which users have that role, to ensure that only trusted users have that permission. Reported By: * Pierre Rudloff [5] Fixed By: * Damien McKenna [6] of the Drupal Security Team * Carsten Logemann [7] * Florent Torregrosa [8] * Pierre Rudloff [9] Coordinated By: * Neil Drumm [10] of the Drupal Security Team [1] https://www.drupal.org/project/matomo [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/matomo/releases/7.x-2.15 [4] https://www.drupal.org/project/matomo/releases/8.x-1.22 [5] https://www.drupal.org/user/3611858 [6] https://www.drupal.org/user/108450 [7] https://www.drupal.org/user/218368 [8] https://www.drupal.org/user/2388214 [9] https://www.drupal.org/user/3611858 [10] https://www.drupal.org/user/3064

1 0