Security-news

Download

security-news@drupal.org

April 2024

1 participants
2 discussions

REST Views - Moderately critical - Information Disclosure - SA-CONTRIB-2024-018
by security-news＠drupal.org 24 Apr '24

24 Apr '24

View online: https://www.drupal.org/sa-contrib-2024-018 Project: REST Views [1] Date: 2024-April-24 Security risk: *Moderately critical* 14∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Information Disclosure Affected versions: <3.0.1 Description: The Rest views module lets site admins create rest exports in views with additional options for serializing data. This module does not accurately check access and may expose paths to unpublished content. This vulnerability is mitigated by the fact that there must be a specific content structure to expose. Paths to unpublished entities (such as nodes) will be exposed if those entities are referenced from other entities listed in a REST display, and the reference field on those listed entities is displayed with the "Entity path" formatter. Solution: Install the latest version: * REST Views 8.x-1.x versions are unsupported. * REST Views 2.x versions upgrade to Rest Views 3.0.1 [3] * REST Views 3.x versions prior to 3.0.1 upgrade to Rest Views 3.0.1 [4] Reported By: * nicxvan [5] Fixed By: * nicxvan [6] Coordinated By: * Benji Fisher [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team * Cathy Theys [9] of the Drupal Security Team [1] https://www.drupal.org/project/rest_views [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/rest_views/releases/3.0.1 [4] https://www.drupal.org/project/rest_views/releases/3.0.1 [5] https://www.drupal.org/user/531480 [6] https://www.drupal.org/user/531480 [7] https://www.drupal.org/user/683300 [8] https://www.drupal.org/user/36762 [9] https://www.drupal.org/user/258568

1 0

Advanced PWA - Critical - Access bypass - SA-CONTRIB-2024-017
by security-news＠drupal.org 24 Apr '24

24 Apr '24

View online: https://www.drupal.org/sa-contrib-2024-017 Project: Advanced PWA [1] Date: 2024-April-24 Security risk: *Critical* 16∕25 AC:None/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <1.5.0 Description: Progressive web applications are web applications that load like regular web pages or websites but can offer the user functionality such as working offline, push notifications, and device hardware access traditionally available only to native applications. This module doesn't sufficiently protect access to the settings form, allowing an unauthorized malicious user to view and modify the module settings. Solution: Install the latest version: * If you use the Advanced Progressive Web App module for Drupal 8.x, upgrade to Advanced Progressive Web App 8.x-1.5 [3] Reported By: * Matthew Grasmick [4] Fixed By: * gMaximus [5] Coordinated By: * Greg Knaddison [6] of the Drupal Security Team * Michael Hess [7] of the Drupal Security Team * cilefen [8] of the Drupal Security Team * Cathy Theys [9] of the Drupal Security Team [1] https://www.drupal.org/project/advanced_pwa [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/advanced_pwa/releases/8.x-1.5 [4] https://www.drupal.org/user/455714 [5] https://www.drupal.org/user/1612496 [6] https://www.drupal.org/user/36762 [7] https://www.drupal.org/user/102818 [8] https://www.drupal.org/user/1850070 [9] https://www.drupal.org/user/258568

1 0