February 2024 - Security-news

Drupal Symfony Mailer Lite - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-014
by security-news＠drupal.org 28 Feb '24

28 Feb '24

View online: https://www.drupal.org/sa-contrib-2024-014 Project: Drupal Symfony Mailer Lite [1] Date: 2024-February-28 Security risk: *Moderately critical* 12∕25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Request Forgery Affected versions: <1.0.6 Description: The module doesn’t sufficiently protect against malicious links, which means an attacker can trick an administrator into performing unwanted actions. This vulnerability is mitigated by the fact that the set of unwanted actions is limited to specific configurations. Solution: Upgrade to Symfony Mailer Lite 1.0.6 [3] and rebuild Drupal's cache. Reported By: * Mingsong [4] Fixed By: * Lee Rowlands [5] of the Drupal Security Team * Wayne Eaker [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team * Juraj Nemec [8] of the Drupal Security Team * Lee Rowlands [9] of the Drupal Security Team [1] https://www.drupal.org/project/symfony_mailer_lite [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/symfony_mailer_lite/releases/1.0.6 [4] https://www.drupal.org/user/2986445 [5] https://www.drupal.org/user/395439 [6] https://www.drupal.org/user/326925 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/272316 [9] https://www.drupal.org/user/395439

1 0

Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-013
by security-news＠drupal.org 28 Feb '24

28 Feb '24

View online: https://www.drupal.org/sa-contrib-2024-013 Project: Node Access Rebuild Progressive [1] Date: 2024-February-28 Security risk: *Less critical* 9∕25 AC:Complex/A:Admin/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: This module provides an alternative mean of rebuilding the Content Access table. The module doesn't sufficiently reset the state of content access when the module is uninstalled. Solution: Install the latest version: * If you use the node_access_rebuild_progressive module for Drupal 7, upgrade to node_access_rebuild_progressive 7.x-1.2 [3] Reported By: * Jen Lampton [4] Provisional Member of the Drupal Security Team Fixed By: * Shelane French [5] * Juraj Nemec [6] of the Drupal Security Team * Jen Lampton [7] Provisional Member of the Drupal Security Team Coordinated By: * Greg Knaddison [8] of the Drupal Security Team * Juraj Nemec [9] of the Drupal Security Team [1] https://www.drupal.org/project/node_access_rebuild_progressive [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/node_access_rebuild_progressive/releases/7.x… [4] https://www.drupal.org/user/85586 [5] https://www.drupal.org/user/2674989 [6] https://www.drupal.org/user/272316 [7] https://www.drupal.org/user/85586 [8] https://www.drupal.org/user/36762 [9] https://www.drupal.org/user/272316

1 0

Private content - Moderately critical - Access bypass - SA-CONTRIB-2024-012
by security-news＠drupal.org 28 Feb '24

28 Feb '24

View online: https://www.drupal.org/sa-contrib-2024-012 Project: Private content [1] Date: 2024-February-28 Security risk: *Moderately critical* 12∕25 AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <2.1.0 Description: This module gives each node a 'private' checkbox. If it's set, the node can only be seen by the node author, or users with the 'access private content' permission. The module incorrectly grants access to private nodes under certain specific circumstances. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Access private content". Solution: Install the latest version: * If you use the Private Content module for Drupal 8.x, upgrade to Private Content 8.x-2.1 [3] Reported By: * kiwimind [4] Fixed By: * Adam Shepherd [5] Coordinated By: * Greg Knaddison [6] of the Drupal Security Team * Juraj Nemec [7] of the Drupal Security Team [1] https://www.drupal.org/project/private_content [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/private_content/releases/8.x-2.1 [4] https://www.drupal.org/user/749470 [5] https://www.drupal.org/user/2650563 [6] https://www.drupal.org/user/36762 [7] https://www.drupal.org/user/272316

1 0

Coffee - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-011
by security-news＠drupal.org 28 Feb '24

28 Feb '24

View online: https://www.drupal.org/sa-contrib-2024-011 Project: Coffee [1] Date: 2024-February-28 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Affected versions: <1.4.0 Description: The Coffee module helps you to navigate through the Drupal admin menus faster with a shortcut popup. The module doesn't sufficiently escape menu names when displaying them in the popup, thereby exposing a XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer menus and menu links". Solution: Install the latest version: * If you use the Coffee module for Drupal 10, upgrade to Coffee 8.x-1.4 [3] Reported By: * Patrick Fey [4] Fixed By: * Michael Mol [5] * Klaus Purer [6] * Oliver Köhler [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/coffee [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/coffee/releases/8.x-1.4 [4] https://www.drupal.org/user/998680 [5] https://www.drupal.org/user/919186 [6] https://www.drupal.org/user/262198 [7] https://www.drupal.org/user/1781874 [8] https://www.drupal.org/user/36762

1 0

Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-010
by security-news＠drupal.org 21 Feb '24

21 Feb '24

View online: https://www.drupal.org/sa-contrib-2024-010 Project: Node Access Rebuild Progressive [1] Date: 2024-February-21 Security risk: *Less critical* 9∕25 AC:Complex/A:Admin/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <2.0.2 Description: This module provides an alternative mean of rebuilding the Content Access table. The module doesn't sufficiently reset the state of content access when the module is uninstalled. Solution: Install the latest version: * If you use the node_access_rebuild_progressive module for Drupal 9.4+, upgrade to node_access_rebuild_progressive 2.0.2 [3] Reported By: * Pierre Rudloff [4] Fixed By: * Pierre Rudloff [5] * Shelane French [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team * Damien McKenna [8] of the Drupal Security Team [1] https://www.drupal.org/project/node_access_rebuild_progressive [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/node_access_rebuild_progressive/releases/2.0… [4] https://www.drupal.org/user/3611858 [5] https://www.drupal.org/user/3611858 [6] https://www.drupal.org/user/2674989 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/108450

1 0

CKEditor 4 LTS - WYSIWYG HTML editor - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-009
by security-news＠drupal.org 14 Feb '24

14 Feb '24

View online: https://www.drupal.org/sa-contrib-2024-009 Project: CKEditor 4 LTS - WYSIWYG HTML editor [1] Date: 2024-February-14 Security risk: *Moderately critical* 12∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross Site Scripting Affected versions: >=1.0.0 <1.0.1 Description: The CKEditor 4 LTS - WYSIWYG HTML editor module uses the CKEditor library for WYSIWYG editing. CKEditor has released a security update [3] that on certain configurations may impact the Drupal module that bundles and integrates this code. The vulnerability is mitigated by the fact it requires: 1) full-page editing [4] mode is enabled 2) or CDATA elements in Advanced Content Filtering configuration (defaults to script and style elements) are enabled. 3) An attacker must have a permission with access to the CKEditor instance. For more information, see CKEditor's security advisory: CVE-2024-24815 [5]: Cross-site scripting (XSS) vulnerability caused by incorrect CDATA detection Solution: Install the latest version: * If you use the CKEditor 4 LTS - WYSIWYG HTML editor module for Drupal 9.4+, upgrade to ckeditor_lts 1.0.1 [6] Reported By: * cilefen [7] of the Drupal Security Team * Juraj Nemec [8] of the Drupal Security Team Fixed By: * Wojciech Kukowski [9] * Jacek Bogdański [10] * Dawid [11] Coordinated By: * Greg Knaddison [12] of the Drupal Security Team * catch [13] of the Drupal Security Team [1] https://www.drupal.org/project/ckeditor_lts [2] https://www.drupal.org/security-team/risk-levels [3] https://ckeditor.com/cke4/release/CKEditor-4.24.0-LTS [4] https://ckeditor.com/docs/ckeditor4/latest/features/fullpage.html [5] https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-fq6h-4g8v-qq… [6] https://www.drupal.org/project/ckeditor_lts/releases/1.0.1 [7] https://www.drupal.org/user/1850070 [8] https://www.drupal.org/user/272316 [9] https://www.drupal.org/user/3104645 [10] https://www.drupal.org/user/3683355 [11] https://www.drupal.org/user/3741013 [12] https://www.drupal.org/user/36762 [13] https://www.drupal.org/user/35733

1 0

Migrate Tools - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-008
by security-news＠drupal.org 07 Feb '24

07 Feb '24

View online: https://www.drupal.org/sa-contrib-2024-008 Project: Migrate Tools [1] Date: 2024-February-07 Security risk: *Moderately critical* 12∕25 AC:Complex/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Request Forgery Affected versions: <6.0.3 Description: The Migrate Tools module provides tools for running and managing Drupal migrations. The module doesn't sufficiently protect against Cross Site Request Forgery under specific scenarios allowing an attacker to initiate a migration. This vulnerability is mitigated by the fact that an attacker must know the name of the migration. Solution: Install the latest version: * If you use the Migrate Tools module for Drupal 10, upgrade to Migrate Tools 6.0.3 [3] Reported By: * Andreas Hennings [4] Fixed By: * Andreas Hennings [5] * Lucas Hedding [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team [1] https://www.drupal.org/project/migrate_tools [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/migrate_tools/releases/6.0.3 [4] https://www.drupal.org/user/459338 [5] https://www.drupal.org/user/459338 [6] https://www.drupal.org/user/1463982 [7] https://www.drupal.org/user/36762

1 0