April 2025 - Security-news - lists.drupal.org

Search API Solr - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2025-046
by security-news＠drupal.org 23 Apr '25

23 Apr '25

View online: https://www.drupal.org/sa-contrib-2025-046 Project: Search API Solr [1] Date: 2025-April-23 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Request Forgery Affected versions: <4.3.9 CVE IDs: CVE-2025-3907 Description: This module provides support for creating searches using the Apache Solr search engine and the Search API Drupal module. The module doesn't sufficiently protect certain routes from CSRF attacks. This vulnerability is mitigated by the fact that a site admin would have to perform further steps after the attack for it to have any effect. Solution: Install the latest version: * If you use the Search API Solr module for Drupal 8+, upgrade to Search API Solr 4.3.10. [3] We also recommend checking your Solr configuration for any unintended changes. Reported By: * Pierre Rudloff (prudloff) [4] Fixed By: * Thomas Seidl (drunken monkey) [5] * Markus Kalkbrenner (mkalkbrenner) [6] Coordinated By: * Greg Knaddison (greggles) [7] of the Drupal Security Team * Drew Webber (mcdruid) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team [1] https://www.drupal.org/project/search_api_solr [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/search_api_solr/releases/4.3.10 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/drunken-monkey [6] https://www.drupal.org/u/mkalkbrenner [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/mcdruid [9] https://www.drupal.org/u/poker10

1 0

Sportsleague - Critical - Unsupported - SA-CONTRIB-2025-045
by security-news＠drupal.org 23 Apr '25

23 Apr '25

View online: https://www.drupal.org/sa-contrib-2025-045 Project: Sportsleague [1] Date: 2025-April-23 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2025-3904 Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [4] [1] https://www.drupal.org/project/sportsleague [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [4] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta…

1 0

UEditor - 百度编辑器 - Critical - Unsupported - SA-CONTRIB-2025-044
by security-news＠drupal.org 23 Apr '25

23 Apr '25

View online: https://www.drupal.org/sa-contrib-2025-044 Project: UEditor - 百度编辑器 [1] Date: 2025-April-23 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2025-3903 Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [4] [1] https://www.drupal.org/project/ueditor [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [4] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta…

1 0

Block Class - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-043
by security-news＠drupal.org 23 Apr '25

23 Apr '25

View online: https://www.drupal.org/sa-contrib-2025-043 Project: Block Class [1] Date: 2025-April-23 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Scripting Affected versions: >=4.0.0 <4.0.1 CVE IDs: CVE-2025-3902 Description: Block Class enables you to add custom attributes to blocks. The module did not sufficiently sanitize custom attribute input, allowing for potential XSS attacks when malicious JavaScript was injected as a custom attribute. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer block classes". Solution: Install the latest version: * If you use the Block Class on 4.0.x upgrade to Block Class 4.0.1 [3] Reported By: * Ivo Van Geertruyen (mr.baileys) [4] of the Drupal Security Team Fixed By: * renatog [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team [1] https://www.drupal.org/project/block_class [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/block_class/releases/4.0.1 [4] https://www.drupal.org/u/mrbaileys [5] https://www.drupal.org/u/renatog [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/poker10

1 0

Bootstrap Site Alert - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-042
by security-news＠drupal.org 23 Apr '25

23 Apr '25

View online: https://www.drupal.org/sa-contrib-2025-042 Project: Bootstrap Site Alert [1] Date: 2025-April-23 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Affected versions: <1.13.0 || >=3.0.0 <3.0.4 CVE IDs: CVE-2025-3901 Description: This module enables you to put a site wide bootstrap themed alert message on the top of every page. The module doesn't sufficiently filter text input when leading to a possible XSS attacks. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer bootstrap site alerts". Solution: Install the latest version: * If you use the bootstrap_site_alert module 8.x-1.x, upgrade to bootstrap_site_alert 8.x-1.23. [3] * If you use the bootstrap_site_alerts module 3.0.x, upgrade to bootstrap_site_alert 3.0.4. [4] Reported By: * Mitch Portier (arkener) [5] * Elijah Byrd (elibyrd) [6] Fixed By: * Mitch Portier (arkener) [7] * Joseph Olstad (joseph.olstad) [8] * Ivo Van Geertruyen (mr.baileys) [9] of the Drupal Security Team Coordinated By: * Greg Knaddison (greggles) [10] of the Drupal Security Team * Juraj Nemec (poker10) [11] of the Drupal Security Team [1] https://www.drupal.org/project/bootstrap_site_alert [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/bootstrap_site_alert/releases/8.x-1.13 [4] https://www.drupal.org/project/bootstrap_site_alert/releases/3.0.4 [5] https://www.drupal.org/u/arkener [6] https://www.drupal.org/u/elibyrd [7] https://www.drupal.org/u/arkener [8] https://www.drupal.org/u/josepholstad [9] https://www.drupal.org/u/mrbaileys [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/poker10

1 0

Colorbox - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-041
by security-news＠drupal.org 23 Apr '25

23 Apr '25

View online: https://www.drupal.org/sa-contrib-2025-041 Project: Colorbox [1] Date: 2025-April-23 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Affected versions: <2.1.3 CVE IDs: CVE-2025-3900 Description: Colorbox is a module that allows Images, and iframed or inline content to be displayed in a modal above the current page. The Colorbox module doesn't sufficiently sanitize data attributes before opening modals. This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes. Solution: Install the latest version: * If you use the Colorbox module 2.1.x for Drupal 10 or above, upgrade to Colorbox 2.1.3 [3] * If you use the Colorbox module 2.0.x, upgrade to Colorbox 2.1.3 [4], as the 2.0.x branch becomes unsupported. Reported By: * Pierre Rudloff (prudloff) [5] Fixed By: * Jen Lampton (jenlampton) [6] * Paul McKibben (paulmckibben) [7] Coordinated By: * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team [1] https://www.drupal.org/project/colorbox [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/colorbox/releases/2.1.3 [4] https://www.drupal.org/project/colorbox/releases/2.1.3 [5] https://www.drupal.org/u/prudloff [6] https://www.drupal.org/u/jenlampton [7] https://www.drupal.org/u/paulmckibben [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10

1 0

Drupal 8 Google Optimize Hide Page - Critical - Unsupported - SA-CONTRIB-2025-040
by security-news＠drupal.org 16 Apr '25

16 Apr '25

View online: https://www.drupal.org/sa-contrib-2025-040 Project: Drupal 8 Google Optimize Hide Page [1] Date: 2025-April-16 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2025-3739 Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [4] [1] https://www.drupal.org/project/d8_google_optimize_hide_page [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [4] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta…

1 0

Google Optimize - Critical - Unsupported - SA-CONTRIB-2025-039
by security-news＠drupal.org 16 Apr '25

16 Apr '25

View online: https://www.drupal.org/sa-contrib-2025-039 Project: Google Optimize [1] Date: 2025-April-16 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2025-3738 Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [4] [1] https://www.drupal.org/project/google_optimize [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [4] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta…

1 0

Google Maps: Store Locator - Critical - Unsupported - SA-CONTRIB-2025-038
by security-news＠drupal.org 16 Apr '25

16 Apr '25

View online: https://www.drupal.org/sa-contrib-2025-038 Project: Google Maps: Store Locator [1] Date: 2025-April-16 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2025-3737 Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [4] [1] https://www.drupal.org/project/gmap_store_locator [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [4] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta…

1 0

Simple GTM - Critical - Unsupported - SA-CONTRIB-2025-037
by security-news＠drupal.org 16 Apr '25

16 Apr '25

View online: https://www.drupal.org/sa-contrib-2025-037 Project: Simple GTM [1] Date: 2025-April-16 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2025-3736 Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [4] [1] https://www.drupal.org/project/simple_gtm [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [4] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta…

1 0