December 2024 - Security-news

Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-076
by security-news＠drupal.org 11 Dec '24

11 Dec '24

View online: https://www.drupal.org/sa-contrib-2024-076 Project: Open Social [1] Date: 2024-December-11 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <12.3.10 || >=12.4.0 <12.4.9 Description: Open Social is a Drupal distribution for online communities, which ships with a default (optional) module social_file_private to ensure the images and files provided by the distribution are stored in the private instead of the public filesystem. During updates from Open Social versions installed prior to 11.8.0 these files were not updated correctly and as a result the module didn't allow access checks to run correctly. Solution: Install the latest version and make sure to run the update hooks. * If you use Open Social 12.3.x upgrade to Open Social 12.3.10 [3] * If you use Open Social 12.4.x upgrade to Open Social 12.4.9 [4] Reported By: * corn696 [5] Fixed By: * corn696 [6] * Robert Ragas [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/social [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/social/releases/12.3.10 [4] https://www.drupal.org/project/social/releases/12.4.9 [5] https://www.drupal.org/user/3544002 [6] https://www.drupal.org/user/3544002 [7] https://www.drupal.org/user/2723261 [8] https://www.drupal.org/user/36762

1 0

Allow All File Extensions for file fields - Critical - Unsupported - SA-CONTRIB-2024-075
by security-news＠drupal.org 11 Dec '24

11 Dec '24

View online: https://www.drupal.org/sa-contrib-2024-075 Project: Allow All File Extensions for file fields [1] Date: 2024-December-11 Security risk: *Critical* 18 ∕ 25 AC:Basic/A:User/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [4] [1] https://www.drupal.org/project/all_extensions [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [4] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta…

1 0

Git Utilities for Drupal - Critical - Unsupported - SA-CONTRIB-2024-074
by security-news＠drupal.org 11 Dec '24

11 Dec '24

View online: https://www.drupal.org/sa-contrib-2024-074 Project: Git Utilities for Drupal [1] Date: 2024-December-11 Security risk: *Critical* 17 ∕ 25 AC:Basic/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [4] [1] https://www.drupal.org/project/git_utils [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [4] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta…

1 0

Login Disable - Critical - Access bypass - SA-CONTRIB-2024-073
by security-news＠drupal.org 11 Dec '24

11 Dec '24

View online: https://www.drupal.org/sa-contrib-2024-073 Project: Login Disable [1] Date: 2024-December-11 Security risk: *Critical* 16 ∕ 25 AC:None/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: >=2.0.0 <2.1.1 Description: This module enables you to prevent existing users from logging in to your Drupal site unless they know the secret key to add to the end of the ?q=user login form page. The Login Disable module does not correctly prevent a user with a disabled login from logging in, allowing those users to by-pass the protection offered by the module. This vulnerability is mitigated by the fact that an attacker must already have a user account to log in. This bug therefore allows users to log in even if their login is disabled. Solution: Install the latest version: * If you use the Login Disable module for Drupal 9.x / 10.x, upgrade to Login Disable 2.1.1 [3] The Drupal 7 version of the module is not affected. Reported By: * e5sego [4] Fixed By: * e5sego [5] * Sang Lostrie [6] Coordinated By: * Ivo Van Geertruyen [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team * Benji Fisher [9] of the Drupal Security Team [1] https://www.drupal.org/project/login_disable [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/login_disable/releases/2.1.1 [4] https://www.drupal.org/user/261590 [5] https://www.drupal.org/user/261590 [6] https://www.drupal.org/user/2727459 [7] https://www.drupal.org/u/mrbaileys [8] https://security.drupal.org/user/27 [9] https://www.drupal.org/u/benjifisher

1 0

Browser Back Button - Moderately critical - Cross site scripting - SA-CONTRIB-2024-072
by security-news＠drupal.org 11 Dec '24

11 Dec '24

View online: https://www.drupal.org/sa-contrib-2024-072 Project: Browser Back Button [1] Date: 2024-December-11 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Affected versions: >=1.0.0 <2.0.2 Description: This module provides a block that renders a link providing the functionality of a browser's back button. The module does not sufficiently escape text entered by an administrator, resulting in a cross scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer blocks". Solution: Install the latest version: * If you use the Browser Back Button module for Drupal 9.x/10.x, upgrade to Browser Back Button 2.0.2 [3] Reported By: * Patrick Fey [4] Fixed By: * Elavarasan R [5] Coordinated By: * Ivo Van Geertruyen [6] of the Drupal Security Team [1] https://www.drupal.org/project/browser_back_button [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/browser_back_button/releases/2.0.2 [4] https://www.drupal.org/user/998680 [5] https://www.drupal.org/user/1902634 [6] https://www.drupal.org/u/mrbaileys

1 0

Entity Form Steps - Moderately critical - Cross site scripting - SA-CONTRIB-2024-071
by security-news＠drupal.org 04 Dec '24

04 Dec '24

View online: https://www.drupal.org/sa-contrib-2024-071 Project: Entity Form Steps [1] Date: 2024-December-04 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Affected versions: <1.1.4 Description: This module allows a site builder to create multi-step entity forms leveraging the Field Group field type plugins. The module doesn't escape plain text administrative configurations. An attacker with admin access could inject arbitrary JavaScript code. This vulnerability is mitigated by the fact that an attacker must have a role with the 'administer [entity_type] form display' permission allowing access to configure entity form displays. Solution: Install the latest version: * If you use the Entity Form Steps module for Drupal 9.x/10.x, upgrade to Entity Form Steps 1.1.4 [3] Reported By: * Ide Braakman [4] Fixed By: * Rob [5] Coordinated By: * Ivo Van Geertruyen [6] of the Drupal Security Team [1] https://www.drupal.org/project/entity_form_steps [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/entity_form_steps/releases/1.1.4 [4] https://www.drupal.org/user/1879760 [5] https://www.drupal.org/user/459772 [6] https://www.drupal.org/u/mrbaileys

1 0

Minify JS - Moderately critical - Cross site request forgery - SA-CONTRIB-2024-070
by security-news＠drupal.org 04 Dec '24

04 Dec '24

View online: https://www.drupal.org/sa-contrib-2024-070 Project: Minify JS [1] Date: 2024-December-04 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site request forgery Affected versions: <3.0.3 Description: The Minify JS module allows a site administrator to minify all javascript files that exist in the site's code base and use those minified files on the front end of the website. Several administrator routes are unprotected against Cross-Site Request Forgery (CRSF) attacks. Solution: Install the latest version: * If you use the Minify JS module for Drupal 7.x, upgrade to Minify JS 7.x-1.11 [3] * If you use the Minify JS module for Drupal 8.x, upgrade to Minify JS 3.0.3 [4] Reported By: * Pierre Rudloff [5] Fixed By: * Ivo Van Geertruyen [6] of the Drupal Security Team * Scott Joudry [7] Coordinated By: * Ivo Van Geertruyen [8] of the Drupal Security Team [1] https://www.drupal.org/project/minifyjs [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/minifyjs/releases/7.x-1.11 [4] https://www.drupal.org/project/minifyjs/releases/3.0.3 [5] https://www.drupal.org/user/3611858 [6] https://www.drupal.org/user/383424 [7] https://www.drupal.org/user/1846786 [8] https://www.drupal.org/user/383424

1 0

Download All Files - Critical - Access bypass - SA-CONTRIB-2024-069
by security-news＠drupal.org 04 Dec '24

04 Dec '24

View online: https://www.drupal.org/sa-contrib-2024-069 Project: Download All Files [1] Date: 2024-December-04 Security risk: *Critical* 16 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Proof/TD:All [2] Vulnerability: Access bypass Affected versions: <2.0.2 Description: This module provides a field formatter for the field type 'file' called `Table of files with download all link` . The module had vulnerabilities allowing a user to download files they normally should not be able to download. Solution: Install the latest version: * If you use the Download All Files module, upgrade to 2.0.2 version [3] Reported By: * Pierre Rudloff [4] * Jeroen Tubex [5] Fixed By: * Jeroen Tubex [6] * striknin [7] * Giuseppe [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team * Damien McKenna [10] of the Drupal Security Team * Ivo Van Geertruyen [11] of the Drupal Security Team [1] https://www.drupal.org/project/download_all_files [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/download_all_files/releases/2.0.2 [4] https://www.drupal.org/user/3611858 [5] https://www.drupal.org/user/2228934 [6] https://www.drupal.org/user/2228934 [7] https://www.drupal.org/user/1234206 [8] https://www.drupal.org/user/3521392 [9] https://www.drupal.org/user/36762 [10] https://www.drupal.org/user/108450 [11] https://www.drupal.org/user/383424

1 0

Pages Restriction Access - Critical - Access bypass - SA-CONTRIB-2024-068
by security-news＠drupal.org 04 Dec '24

04 Dec '24

View online: https://www.drupal.org/sa-contrib-2024-068 Project: Pages Restriction Access [1] Date: 2024-December-04 Security risk: *Critical* 15 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: >=2.0.0 <2.0.3 Description: Module to restrict access from anonymous and regular users to configured pre-defined pages. The module does not adequately handle protecting certain types of URLs. Solution: Install the latest version: * If you use the Pages Restriction Access for Drupal 8.x or higher, upgrade to Pages Restriction Access for Drupal 2.0.3 [3] Reported By: * Pierre Rudloff [4] * Ivo Van Geertruyen [5] of the Drupal Security Team Fixed By: * renatog [6] * Pierre Rudloff [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team * Damien McKenna [9] of the Drupal Security Team * Juraj Nemec [10] of the Drupal Security Team * Ivo Van Geertruyen [11] of the Drupal Security Team [1] https://www.drupal.org/project/pages_restriction [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/pages_restriction/releases/2.0.3 [4] https://www.drupal.org/user/3611858 [5] https://www.drupal.org/user/383424 [6] https://www.drupal.org/user/3326031 [7] https://www.drupal.org/user/3611858 [8] https://www.drupal.org/user/36762 [9] https://www.drupal.org/user/108450 [10] https://www.drupal.org/user/272316 [11] https://www.drupal.org/u/mrbaileys

1 0

OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) - Critical - Cross Site Scripting - SA-CONTRIB-2024-067
by security-news＠drupal.org 04 Dec '24

04 Dec '24

View online: https://www.drupal.org/sa-contrib-2024-067 Project: OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) [1] Date: 2024-December-04 Security risk: *Critical* 16 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Affected versions: >=3.0.0 <3.44.0 || >=4.0.0 <4.0.19 Description: This module enables you to authenticate users through an Identity Provider (IdP) or OAuth Server, allowing them to log in to your Drupal site. The module does not sufficiently escape query parameters sent to the callback URL when displaying error messages, particularly if the code parameter is missing in the response. Solution: Install the latest version: * If you use the OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) module 8.x-3.x for Drupal 9 and Drupal 10, upgrade to miniorange_oauth_client 8.x-3.44 [3]. * If you use the OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) module 4.x for Drupal 9, Drupal 10 and Drupal 11, upgrade to miniorange_oauth_client 4.0.19 [4]. * If you use the OAuth & OpenID Connect Single Sign On – SSO (OAuth/OIDC Client) module 7.x-1.x for Drupal 7, upgrade to miniorange_oauth_client 7.x-1.355 [5]. Reported By: * Borut Piletic [6] Fixed By: * Borut Piletic [7] * singh_ankit [8] * Ivo Van Geertruyen [9] of the Drupal Security Team Coordinated By: * Greg Knaddison [10] of the Drupal Security Team * Damien McKenna [11] of the Drupal Security Team [1] https://www.drupal.org/project/miniorange_oauth_client [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/miniorange_oauth_client/releases/8.x-3.44 [4] https://www.drupal.org/project/miniorange_oauth_client/releases/4.0.19 [5] https://www.drupal.org/project/miniorange_oauth_client/releases/7.x-1.355 [6] https://www.drupal.org/user/2714887 [7] https://www.drupal.org/user/2714887 [8] https://www.drupal.org/user/3723914 [9] https://www.drupal.org/user/383424 [10] https://www.drupal.org/user/36762 [11] https://www.drupal.org/user/108450

1 0