Security-news

Download

security-news@drupal.org

February 2025

1 participants
11 discussions

OAuth2 Client - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-013
by security-news＠drupal.org 05 Feb '25

05 Feb '25

View online: https://www.drupal.org/sa-contrib-2025-013 Project: OAuth2 Client [1] Date: 2025-February-05 Security risk: *Moderately critical* 12 ∕ 25 AC:Complex/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Request Forgery Affected versions: <4.1.3 Description: This module enables a developer to create dedicated OAuth2 clients for connecting to external APIs and other OAuth protected resources. The module does not use Cross Site Request Forgery (CSRF) tokens to protect routes for enabling a client. This vulnerability is mitigated by the fact that an attacker must know the machine name of the client and deceive another user with this permission. Solution: Install the latest version: * If you use the Oauth2 Client module for Drupal 10 or 11, upgrade to Oauth2 Client 4.1.3 [3] Reported By: * Tobias Bähr [4] Fixed By: * Shawn Duncan [5] * Tobias Bähr [6] Coordinated By: * cilefen [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/oauth2_client [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/oauth2_client/releases/4.1.3 [4] https://www.drupal.org/user/183956 [5] https://www.drupal.org/user/628748 [6] https://www.drupal.org/user/183956 [7] https://www.drupal.org/u/cilefen [8] https://www.drupal.org/user/36762

1 0