Security-news

Download

security-news@drupal.org

November 2024

1 participants
12 discussions

Tooltip - Moderately critical - Cross site scripting - SA-CONTRIB-2024-058
by security-news＠drupal.org 06 Nov '24

06 Nov '24

View online: https://www.drupal.org/sa-contrib-2024-058 Project: Tooltip [1] Date: 2024-November-06 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Affected versions: <1.1.2 Description: This module enables you to add any HTML content you want in a tooltip displayed on mouse hover. The module does not sufficiently escape the markup inserted in the tooltip block. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer blocks". Solution: Install the latest version: * If you use the Tooltip module for Drupal 8.x, 9.x or 10.x, upgrade to Tooltip 1.1.2 [3] Reported By: * Pierre Rudloff [4] Fixed By: * Matthieu Scarset [5] Coordinated By: * Greg Knaddison [6] of the Drupal Security Team * Juraj Nemec [7] of the Drupal Security Team * Ivo Van Geertruyen [8] of the Drupal Security Team [1] https://www.drupal.org/project/tooltip [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/tooltip/releases/1.1.2 [4] https://www.drupal.org/user/3611858 [5] https://www.drupal.org/user/3471281 [6] https://www.drupal.org/user/36762 [7] https://www.drupal.org/user/272316 [8] https://www.drupal.org/u/mrbaileys

1 0

Basic HTTP Authentication - Critical - Access bypass - SA-CONTRIB-2024-057
by security-news＠drupal.org 06 Nov '24

06 Nov '24

View online: https://www.drupal.org/sa-contrib-2024-057 Project: Basic HTTP Authentication [1] Date: 2024-November-06 Security risk: *Critical* 16 ∕ 25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Description: The module provides a possibility to restrict access to specific paths using basic HTTP authentication, in addition to standard Drupal access checks. In some cases, the module removes existing access checks from some paths, resulting in an access bypass vulnerability. Solution: Install the latest version: * If you use the Basic HTTP Authentication module for Drupal 7.x, upgrade to Basic Authentication 7.x-1.4 [3] Reported By: * Roderik Muit [4] Fixed By: * Roderik Muit [5] * Ivo Van Geertruyen [6] of the Drupal Security Team Coordinated By: * Ivo Van Geertruyen [7] of the Drupal Security Team [1] https://www.drupal.org/project/basic_auth [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/basic_auth/releases/7.x-1.4 [4] https://www.drupal.org/user/8841 [5] https://www.drupal.org/user/8841 [6] https://www.drupal.org/user/383424 [7] https://www.drupal.org/user/383424

1 0