May 2025 - Security-news - lists.drupal.org

COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-076
by security-news＠drupal.org 28 May '25

28 May '25

View online: https://www.drupal.org/sa-contrib-2025-076 Project: COOKiES Consent Management [1] Date: 2025-May-28 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Scripting Affected versions: <1.2.15 CVE IDs: CVE-2025-48915 Description: The COOKIES module protects users from executing JavaScript code provided by third parties, e.g., to display ads or track user data without consent. Each sub-module allows to include a specific third party service in the consent management, by controlling the execution of javascript. However, this does not adequately check whether the provided JavaScript code originates from authorized users. A potential attacker would at least need permission to create and publish HTML (e.g. content or comments). Solution: Install the latest version: * If you use the COOKiES Consent Management module for Drupal 9 or above, upgrade to COOKiES Consent Management 1.2.15 [3] Reported By: * Pierre Rudloff (prudloff) [4] Fixed By: * Joachim Feltkamp (jfeltkamp) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team * Cathy Theys (yesct) [8] of the Drupal Security Team [1] https://www.drupal.org/project/cookies [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/cookies/releases/1.2.15 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/jfeltkamp [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/poker10 [8] https://www.drupal.org/u/yesct

1 0

COOKiES Consent Management - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-075
by security-news＠drupal.org 28 May '25

28 May '25

View online: https://www.drupal.org/sa-contrib-2025-075 Project: COOKiES Consent Management [1] Date: 2025-May-28 Security risk: *Moderately critical* 12 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Affected versions: <1.2.15 CVE IDs: CVE-2025-48914 Description: This module provides a format filter, which allows you to "disable" certain HTML elements (e.g. remove their src attribute) specified by the user. These elements will be enabled again, once the COOKiES banner is accepted. The module doesn't sufficiently check whether to convert "data-src" attributes to "src" when their value might contain malicious content under the scenario, that module specific classes are set on the HTML element. This vulnerability is mitigated by the fact that the site must have the COOKiES filter submodule enabled and an attacker must have the correct permissions to have a specific HTML element display for all users, and this HTML element needs to have three concise classes set. Solution: Install the latest version: * If you use the COOKiES Consent Management module for Drupal 9 or above, upgrade to COOKiES Consent Management 1.2.15 [3] Reported By: * Pierre Rudloff (prudloff) [4] Fixed By: * Julian Pustkuchen (anybody) [5] * Joshua Sedler (grevil) [6] * Joachim Feltkamp (jfeltkamp) [7] Coordinated By: * Juraj Nemec (poker10) [8] of the Drupal Security Team * Cathy Theys (yesct) [9] of the Drupal Security Team [1] https://www.drupal.org/project/cookies [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/cookies/releases/1.2.15 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/anybody [6] https://www.drupal.org/u/grevil [7] https://www.drupal.org/u/jfeltkamp [8] https://www.drupal.org/u/poker10 [9] https://www.drupal.org/u/yesct

1 0

etracker - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-074
by security-news＠drupal.org 28 May '25

28 May '25

View online: https://www.drupal.org/sa-contrib-2025-074 Project: etracker [1] Date: 2025-May-28 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Scripting Affected versions: <3.1.0 CVE IDs: CVE-2025-48920 Description: The module adds the etracker web statistics tracking system to your website. The cookies_etracker submodule allows the inline JavaScript to be included in consent management. However, this does not adequately check whether the provided JavaScript code originates from authorized users. A potential attacker would at least need permission to create and publish HTML (e.g. content or comments). Solution: Install the latest version: * If you use the etracker module for Drupal 9 and above, upgrade to etracker 8.x-3.1 [3] Reported By: * Pierre Rudloff (prudloff) [4] Fixed By: * Julian Pustkuchen (anybody) [5] * Sven Schüring (sunlix) [6] Coordinated By: * Juraj Nemec (poker10) [7] of the Drupal Security Team * Pierre Rudloff (prudloff) [8] * Cathy Theys (yesct) [9] of the Drupal Security Team [1] https://www.drupal.org/project/etracker [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/etracker/releases/8.x-3.1 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/anybody [6] https://www.drupal.org/u/sunlix [7] https://www.drupal.org/u/poker10 [8] https://www.drupal.org/u/prudloff [9] https://www.drupal.org/u/yesct

1 0

Simple Klaro - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-073
by security-news＠drupal.org 28 May '25

28 May '25

View online: https://www.drupal.org/sa-contrib-2025-073 Project: Simple Klaro [1] Date: 2025-May-28 Security risk: *Moderately critical* 13 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Affected versions: <1.10.0 CVE IDs: CVE-2025-48919 Description: The "Simple Klaro" module adds the "Klaro! A Simple Consent Manager" to your website and allows you to configure it according to your needs in the Drupal backend. The module doesn't sufficiently sanitise data attributes allowing persistent Cross Site Scripting (XSS) attacks. This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes. Solution: Install the latest version: * If you use the "Simple Klaro" module for Drupal 9.x/10.x/11.x, upgrade to Simple Klaro 1.10.0 [3] Reported By: * Pierre Rudloff (prudloff) [4] Fixed By: * Norman Kämper-Leymann (norman.lol) [5] Coordinated By: * Juraj Nemec (poker10) [6] of the Drupal Security Team * Pierre Rudloff (prudloff) [7] * Cathy Theys (yesct) [8] of the Drupal Security Team [1] https://www.drupal.org/project/simple_klaro [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/simple_klaro/releases/1.10.0 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/normanlol [6] https://www.drupal.org/u/poker10 [7] https://www.drupal.org/u/prudloff [8] https://www.drupal.org/u/yesct

1 0

EU Cookie Compliance (GDPR Compliance) - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-072
by security-news＠drupal.org 28 May '25

28 May '25

View online: https://www.drupal.org/sa-contrib-2025-072 Project: EU Cookie Compliance (GDPR Compliance) [1] Date: 2025-May-28 Security risk: *Moderately critical* 13 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Affected versions: <1.26.0 CVE IDs: CVE-2025-48917 Description: This module addresses the General Data Protection Regulation (GDPR) and the EU Directive on Privacy and Electronic Communications. The module doesn't sufficiently verify whether "disabled JavaScript" entries are valid or correspond to actual scripts on the page. As a result, an attacker could inject and execute arbitrary JavaScript by adding invalid or non-existent entries, which the module then attempts to process. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer EU Cookie Compliance banner". Solution: Install the latest version: * If you use EU Cookie Compliance (GDPR Compliance) module for Drupal 10+, upgrade to EU Cookie Compliance (GDPR Compliance) 8.x-1.26 [3] Reported By: * Pierre Rudloff (prudloff) [4] Fixed By: * Grant McEwan (atowl) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team * Cathy Theys (yesct) [8] of the Drupal Security Team [1] https://www.drupal.org/project/eu_cookie_compliance [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/eu_cookie_compliance/releases/8.x-1.26 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/atowl [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/poker10 [8] https://www.drupal.org/u/yesct

1 0

Simple Klaro - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-071
by security-news＠drupal.org 28 May '25

28 May '25

View online: https://www.drupal.org/sa-contrib-2025-071 Project: Simple Klaro [1] Date: 2025-May-28 Security risk: *Moderately critical* 13 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Affected versions: <1.10.0 CVE IDs: CVE-2025-48918 Description: The "Simple Klaro" module adds the "Klaro! A Simple Consent Manager" to your website and allows you to configure it according to your needs in the Drupal backend. The module doesn't sufficiently mark its administrative permission as restricted, creating the possibility for the permission to be granted too broadly. A malicious admin could execute a Cross Site Scripting (XSS) attack. This vulnerability is mitigated by the fact that an attacker must have a role with the "administer simple klaro" permission. Solution: Install the latest version: * If you use the "Simple Klaro" module for Drupal 9.x/10.x/11.x, upgrade to Simple Klaro 1.10.0 [3] Reported By: * Pierre Rudloff (prudloff) [4] Fixed By: * Norman Kämper-Leymann (norman.lol) [5] Coordinated By: * Juraj Nemec (poker10) [6] of the Drupal Security Team * Pierre Rudloff (prudloff) [7] * Cathy Theys (yesct) [8] of the Drupal Security Team [1] https://www.drupal.org/project/simple_klaro [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/simple_klaro/releases/1.10.0 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/normanlol [6] https://www.drupal.org/u/poker10 [7] https://www.drupal.org/u/prudloff [8] https://www.drupal.org/u/yesct

1 0

Bookable Calendar - Less critical - Access bypass - SA-CONTRIB-2025-070
by security-news＠drupal.org 28 May '25

28 May '25

View online: https://www.drupal.org/sa-contrib-2025-070 Project: Bookable Calendar [1] Date: 2025-May-28 Security risk: *Less critical* 9 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <2.2.13 CVE IDs: CVE-2025-48916 Description: This module enables you to setup a repeating date rule that users can "book" different dates, allowing you to let users register for a variety of different things like conference rooms or guitar lessons. This module has a permission of "view booking" and "view booking contact" which allows you to view them regardless of whether you own them or not. Due to bad naming of the permissions it's likely admins have configured those to users that shouldn't have them. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "view booking" or "view booking contact". Solution: Install the latest version: * If you use the Bookable Calendar module for Drupal 8.x, upgrade to Bookable Calendar 2.2.13 [3] .. Manual Steps to patch issue This fix requires a View update to resolve the issue. The full view config can be found in: config/install/views.view.booking_contant.yml. If you haven't customised this view yourself, you can just re-import the view config, either through the Config Sync UI or through drush like this: drush cim --partial --source=modules/contrib/bookable_calendar/config/install. The Drush config import will import all View changes to the whole module, not just this one view. If you want to manually update the view through the Views UI, go to admin/structure/views/view/booking_contact and edit both the User Bookings and Past Bookings display on the view. The only change required is in the Contextual Filter, add a Validation Criteria under the section (when the filter is in the URL or a default is provided) and set the Action to "Display 'Access Denied'". Reported By: * Ludo Hartzema (absoludo) [4] Fixed By: * Ludo Hartzema (absoludo) [5] * Josh Fabean (josh.fabean) [6] Coordinated By: * Bram Driesen (bramdriesen) [7] * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team * Cathy Theys (yesct) [10] of the Drupal Security Team [1] https://www.drupal.org/project/bookable_calendar [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/bookable_calendar/releases/2.2.13 [4] https://www.drupal.org/u/absoludo [5] https://www.drupal.org/u/absoludo [6] https://www.drupal.org/u/joshfabean [7] https://www.drupal.org/u/bramdriesen [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://www.drupal.org/u/yesct

1 0

Lightgallery - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-069
by security-news＠drupal.org 21 May '25

21 May '25

View online: https://www.drupal.org/sa-contrib-2025-069 Project: Lightgallery [1] Date: 2025-May-21 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Scripting Affected versions: <1.6.0 CVE IDs: CVE-2025-48447 Description: This module integrates Drupal with LightGallery, enabling the use of the LightGallery library with any image field or view. The module does not adequately sanitize user input in the image field’s "alt" attribute, potentially allowing cross-site scripting (XSS) attacks when tags or scripts are inserted. This vulnerability is partially mitigated by the requirement that an attacker must have permission to create content containing an image field configured to use the LightGallery format. Solution: Install the latest version: * If you use the Lightgallery module, upgrade to Lightgallery 8.x-1.6 [3] Reported By: * Pierre Rudloff (prudloff) [4] Fixed By: * Murilo Henrique Pucci (murilohp) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team * Pierre Rudloff (prudloff) [8] [1] https://www.drupal.org/project/lightgallery [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/lightgallery/releases/8.x-1.6 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/murilohp [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/poker10 [8] https://www.drupal.org/u/prudloff

1 0

Admin Audit Trail - Less critical - Denial of Service - SA-CONTRIB-2025-068
by security-news＠drupal.org 21 May '25

21 May '25

View online: https://www.drupal.org/sa-contrib-2025-068 Project: Admin Audit Trail [1] Date: 2025-May-21 Security risk: *Less critical* 9 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:Default [2] Vulnerability: Denial of Service Affected versions: <1.0.5 CVE IDs: CVE-2025-48448 Description: The Admin Audit Trail module tracks logs of specific events that you'd like to review. When the submodule Admin Audit Trail: User Authentication is enabled, it logs user authentication events (login, logout, and password reset requests). The module does not sufficiently limit some large values before logging the data. Solution: Install the latest version: * If you use the Admin Audit Trail module for Drupal 9/10/11, upgrade to Admin Audit Trail 1.0.5 [3] Reported By: * Scott Phillips (scottatdrake) [4] Fixed By: * Rajab Natshah (rajab natshah) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team [1] https://www.drupal.org/project/admin_audit_trail [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/admin_audit_trail/releases/1.0.5 [4] https://www.drupal.org/u/scottatdrake [5] https://www.drupal.org/u/rajab-natshah [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/poker10

1 0

Commerce Alphabank Redirect - Moderately critical - Access bypass - SA-CONTRIB-2025-067
by security-news＠drupal.org 21 May '25

21 May '25

View online: https://www.drupal.org/sa-contrib-2025-067 Project: Commerce Alphabank Redirect [1] Date: 2025-May-21 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <1.0.3 CVE IDs: CVE-2025-48446 Description: This module enables you to pay for Commerce order to an environment provided and secured by the bank The module doesn't sufficiently verify the payment status on canceled orders. An attacker can issue a specially crafted request to update the order status to completed. Solution: Install the latest version: * If you use the commerce_alphabank_redirect module for Drupal 8.x, upgrade to commerce_alphabank_redirect 1.0.3 [3] Reported By: * Marios Tsalkidis (silios) [4] Fixed By: * Bill Seremetis (bserem) [5] * Panagiotis Moutsopoulos (vensires) [6] Coordinated By: * Greg Knaddison (greggles) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team [1] https://www.drupal.org/project/commerce_alphabank_redirect [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/commerce_alphabank_redirect/releases/1.0.3 [4] https://www.drupal.org/u/silios [5] https://www.drupal.org/u/bserem [6] https://www.drupal.org/u/vensires [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/poker10

1 0