Security-news March 2024

security-news@drupal.org

1 participants
2 discussions

TacJS - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-016
by security-news＠drupal.org 27 Mar '24

27 Mar '24

View online: https://www.drupal.org/sa-contrib-2024-016 Project: TacJS [1] Date: 2024-March-27 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Affected versions: <6.5.0 Description: This module enables sites to comply with the European cookie law using tarteaucitron.js. The module doesn't sufficiently filter user-supplied markup inside of content leading to a persistent Cross Site Scripting (XSS) vulnerability. More details are available in CVE-2023-3620 [3]. This vulnerability is mitigated by the fact that an attacker needs to be able to write content in the page, a feature commonly available on Drupal sites. Solution: Install the latest version: * If you use the tacjs module for Drupal 8.x, upgrade to tacjs 8.x-6.5 [4] Reported By: * Pierre Rudloff [5] Fixed By: * Frank Mably [6] * Pierre Rudloff [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/tacjs [2] https://www.drupal.org/security-team/risk-levels [3] https://nvd.nist.gov/vuln/detail/CVE-2023-3620 [4] https://www.drupal.org/project/tacjs/releases/8.x-6.5 [5] https://www.drupal.org/user/3611858 [6] https://www.drupal.org/user/3375160 [7] https://www.drupal.org/user/3611858 [8] https://www.drupal.org/user/36762

1 0

Registration role - Critical - Access bypass - SA-CONTRIB-2024-015
by security-news＠drupal.org 06 Mar '24

06 Mar '24

View online: https://www.drupal.org/sa-contrib-2024-015 Project: Registration role [1] Date: 2024-March-06 Security risk: *Critical* 18∕25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <2.0.1 Description: The Registration role module lets an administrator select a role (or multiple roles) to automatically assign to new users. The selected role (or roles) will be assigned to new registrants. The module has a logic error when handling sites that upgraded code and did not run the Drupal update process (e.g. update.php). This vulnerability is mitigated by the fact that the problem does not exist on sites that followed the process of updating code and running the standard updates. Solution: Install the latest version: * If you use the Registration role module version 2.x, upgrade to Registration role 2.0.1 [3] Review user accounts registered between 2023 July 11 and now for having additional roles you did not intend for them to have. If your site missed or reverted an update to configuration in the version 2.0.0 release of Registration Role (or development branch from 2020 August 17 on), non-selected roles were not removed from configuration. Without this update, up until you re-saved the settings form or until you install the new release - whichever came first - users who registered receive /all/ roles. Also, upgrade to the latest version /and run update hooks/ at update.php or with Drush, drush updb OR: Immediately re-save the the configuration page at /admin/people/registration-role Reported By: * Pamela Barone [4] * Renaud Joubert [5] Fixed By: * Juraj Nemec [6] of the Drupal Security Team * Benjamin Melançon [7] Coordinated By: * Juraj Nemec [8] of the Drupal Security Team * Greg Knaddison [9] of the Drupal Security Team * Drew Webber [10] of the Drupal Security Team [1] https://www.drupal.org/project/registration_role [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/registration_role/releases/2.0.1 [4] https://www.drupal.org/user/1431110 [5] https://www.drupal.org/user/549974 [6] https://www.drupal.org/user/272316 [7] https://www.drupal.org/user/64383 [8] https://www.drupal.org/user/272316 [9] https://www.drupal.org/user/36762 [10] https://www.drupal.org/user/255969

1 0

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news March 2024