May 2025 - Security-news - lists.drupal.org

Commerce Eurobank (Redirect) - Moderately critical - Access bypass - SA-CONTRIB-2025-066
by security-news＠drupal.org 21 May '25

21 May '25

View online: https://www.drupal.org/sa-contrib-2025-066 Project: Commerce Eurobank (Redirect) [1] Date: 2025-May-21 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <2.1.1 CVE IDs: CVE-2025-48445 Description: This module enables you to pay for Commerce order to an environment provided and secured by the bank The module doesn't sufficiently verify the payment status on canceled orders. An attacker can issue a specially crafted request to update the order status to completed. Solution: Install the latest version: * If you use the commerce_eurobank_redirect module for Drupal 8.x, upgrade to commerce_eurobank_redirect 2.1.1 [3] Reported By: * Marios Tsalkidis (silios) [4] Fixed By: * Bill Seremetis (bserem) [5] * Panagiotis Moutsopoulos (vensires) [6] Coordinated By: * Greg Knaddison (greggles) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team [1] https://www.drupal.org/project/commerce_eurobank_redirect [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/commerce_eurobank_redirect/releases/2.1.1 [4] https://www.drupal.org/u/silios [5] https://www.drupal.org/u/bserem [6] https://www.drupal.org/u/vensires [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/poker10

1 0

Quick Node Block - Moderately critical - Access bypass - SA-CONTRIB-2025-065
by security-news＠drupal.org 21 May '25

21 May '25

View online: https://www.drupal.org/sa-contrib-2025-065 Project: Quick Node Block [1] Date: 2025-May-21 Security risk: *Moderately critical* 13 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <2.0.0 CVE IDs: CVE-2025-48013 Description: This module provides a block to easily display a rendered node. Access to the rendered node isn't validated before rendering the block. Allowing access to node content for users that would normally not be allowed to access the node. Solution: Update to the latest version. * If you use the Quick Node Block module, update to Quick Node Block 2.0.1 [3] Reported By: * Mitch Portier (arkener) [4] Fixed By: * Mitch Portier (arkener) [5] * Antonio Sánchez (saesa) [6] Coordinated By: * Greg Knaddison (greggles) [7] of the Drupal Security Team * Ivo Van Geertruyen (mr.baileys) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team [1] https://www.drupal.org/project/quick_node_block [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/quick_node_block/releases/2.0.1 [4] https://www.drupal.org/u/arkener [5] https://www.drupal.org/u/arkener [6] https://www.drupal.org/u/saesa [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/mrbaileys [9] https://www.drupal.org/u/poker10

1 0

Quick Node Block - Moderately critical - Access bypass - SA-CONTRIB-2025-064
by security-news＠drupal.org 21 May '25

21 May '25

View online: https://www.drupal.org/sa-contrib-2025-064 Project: Quick Node Block [1] Date: 2025-May-21 Security risk: *Moderately critical* 11 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <2.0.0 CVE IDs: CVE-2025-48444 Description: This module provides a block to easily display a rendered node. The module doesn't check access to content before displaying it to a visitor, allowing unauthorized users to retrieve a list of labels of all nodes. Solution: Update to the latest version. * If you use the Quick Node Block module, update to Quick Node Block 2.0.1 [3] Reported By: * Mitch Portier (arkener) [4] Fixed By: * Mitch Portier (arkener) [5] * Antonio Sánchez (saesa) [6] Coordinated By: * Greg Knaddison (greggles) [7] of the Drupal Security Team * Ivo Van Geertruyen (mr.baileys) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team [1] https://www.drupal.org/project/quick_node_block [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/quick_node_block/releases/2.0.1 [4] https://www.drupal.org/u/arkener [5] https://www.drupal.org/u/arkener [6] https://www.drupal.org/u/saesa [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/mrbaileys [9] https://www.drupal.org/u/poker10

1 0

One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-063
by security-news＠drupal.org 14 May '25

14 May '25

View online: https://www.drupal.org/sa-contrib-2025-063 Project: One Time Password [1] Date: 2025-May-14 Security risk: *Moderately critical* 14 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <1.3.0 CVE IDs: CVE-2025-48012 Description: This module enables you to allow users to include a second authentication method in addition to password authentication. The module doesn't sufficiently prevent the same TFA token within a 30 second window. This vulnerability is mitigated by the fact that an attacker must obtain a valid username/password and second factor. Solution: Install the latest version: * If you use the One Time Password module for Drupal, upgrade to One Time Password 8.x-1.3 [3] Reported By: * Conrad Lara (cmlara) [4] Fixed By: * danielveza [5] * Lee Rowlands (larowlan) [6] of the Drupal Security Team * Ivo Van Geertruyen (mr.baileys) [7] of the Drupal Security Team Coordinated By: * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team [1] https://www.drupal.org/project/one_time_password [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/one_time_password/releases/8.x-1.3 [4] https://www.drupal.org/u/cmlara [5] https://www.drupal.org/u/danielveza [6] https://www.drupal.org/u/larowlan [7] https://www.drupal.org/u/mrbaileys [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10

1 0

One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-062
by security-news＠drupal.org 14 May '25

14 May '25

View online: https://www.drupal.org/sa-contrib-2025-062 Project: One Time Password [1] Date: 2025-May-14 Security risk: *Moderately critical* 14 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <1.3.0 CVE IDs: CVE-2025-48011 Description: This module enables you to allow users to include a second authentication method in addition to password authentication. The module doesn't sufficiently prevent TFA from being bypassed when using the REST login routes. A new requirements check has been added to the status report so other authentication providers can be assessed to check if they also allow for this bypass. This vulnerability is mitigated by the fact that an attacker must obtain a valid username/password. Solution: Install the latest version: * If you use the One Time Password module for Drupal, upgrade to One Time Password 8.x-1.3 [3] Reported By: * Conrad Lara (cmlara) [4] Fixed By: * danielveza [5] * Kim Pepper (kim.pepper) [6] * Lee Rowlands (larowlan) [7] of the Drupal Security Team Coordinated By: * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team [1] https://www.drupal.org/project/one_time_password [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/one_time_password/releases/8.x-1.3 [4] https://www.drupal.org/u/cmlara [5] https://www.drupal.org/u/danielveza [6] https://www.drupal.org/u/kimpepper [7] https://www.drupal.org/u/larowlan [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10

1 0

One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-061
by security-news＠drupal.org 14 May '25

14 May '25

View online: https://www.drupal.org/sa-contrib-2025-061 Project: One Time Password [1] Date: 2025-May-14 Security risk: *Moderately critical* 14 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <1.3.0 CVE IDs: CVE-2025-48010 Description: This module enables you to allow users to include a second authentication method in addition to password authentication. The module doesn't sufficiently prevent one time login links from bypassing TFA. This vulnerability is mitigated by the fact that an attacker must have access to an email account attached to a user or a valid one time password link for a user. Solution: Install the latest version: * If you use the One Time Password module for Drupal, upgrade to One Time Password 8.x-1.3 [3] Reported By: * Conrad Lara (cmlara) [4] Fixed By: * danielveza [5] * Kim Pepper (kim.pepper) [6] * Lee Rowlands (larowlan) [7] of the Drupal Security Team Coordinated By: * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team [1] https://www.drupal.org/project/one_time_password [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/one_time_password/releases/8.x-1.3 [4] https://www.drupal.org/u/cmlara [5] https://www.drupal.org/u/danielveza [6] https://www.drupal.org/u/kimpepper [7] https://www.drupal.org/u/larowlan [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10

1 0

Single Content Sync - Moderately critical - Access bypass - SA-CONTRIB-2025-060
by security-news＠drupal.org 14 May '25

14 May '25

View online: https://www.drupal.org/sa-contrib-2025-060 Project: Single Content Sync [1] Date: 2025-May-14 Security risk: *Moderately critical* 10 ∕ 25 AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <1.4.12 CVE IDs: CVE-2025-48009 Description: This module enables you to seamlessly migrate and deploy content across environments, eliminating manual steps. It simplifies the process by exporting content to a YML file or a ZIP archive, which can be imported into another environment effortlessly. While the export feature rightfully bypasses implemented access controls, enabling it to extract all entity data, including private and confidential information, to the mentioned formats, it fails to adequately safeguard the generated output. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "export single content" or "Allow user to export all content". Solution: Install the latest version: * If you use the Single Content Sync module for Drupal, upgrade to Single Content Sync 1.4.12. [3] Reported By: * Dezső Biczó (mxr576) [4] Fixed By: * Dave Long (longwave) [5] of the Drupal Security Team * Dezső Biczó (mxr576) [6] * Oleksandr Kuzava (nginex) [7] Coordinated By: * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team [1] https://www.drupal.org/project/single_content_sync [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/single_content_sync/releases/1.4.12 [4] https://www.drupal.org/u/mxr576 [5] https://www.drupal.org/u/longwave [6] https://www.drupal.org/u/mxr576 [7] https://www.drupal.org/u/nginex [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10

1 0

Events Log Track - Moderately critical - Denial of Service - SA-CONTRIB-2025-059
by security-news＠drupal.org 14 May '25

14 May '25

View online: https://www.drupal.org/sa-contrib-2025-059 Project: Events Log Track [1] Date: 2025-May-14 Security risk: *Moderately critical* 10 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:All [2] Vulnerability: Denial of Service Affected versions: <3.1.11 || >=4.0.0 <4.0.2 CVE IDs: CVE-2025-4416 Description: The Events Log Track module enables you to log specific events on a Drupal site. The module doesn't sufficiently mitigate resource consumption for certain requests which allows a Denial of Service attack. Solution: Install the latest version: * If you use the event_log_track_auth_user_login_validate sub-module for Drupal 10.x or 11.x, upgrade to events_log_track 4.0.2 [3] or events_log_track 3.1.11 [4] Reported By: * Scott Phillips (scottatdrake) [5] Fixed By: * Mingsong (mingsong) [6] * Stephen Mustgrave (smustgrave) [7] Coordinated By: * Greg Knaddison (greggles) [8] of the Drupal Security Team [1] https://www.drupal.org/project/events_log_track [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/events_log_track/releases/4.0.2 [4] https://www.drupal.org/project/events_log_track/releases/3.1.11 [5] https://www.drupal.org/u/scottatdrake [6] https://www.drupal.org/u/mingsong [7] https://www.drupal.org/u/smustgrave [8] https://www.drupal.org/u/greggles

1 0

Piwik PRO - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-058
by security-news＠drupal.org 14 May '25

14 May '25

View online: https://www.drupal.org/sa-contrib-2025-058 Project: Piwik PRO [1] Date: 2025-May-14 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Affected versions: <1.3.2 CVE IDs: CVE-2025-4415 Description: This module enables you to add the Piwik Pro web statistics tracking system to your website. The module does not check the JS code that is loaded on the website. So a user with the "Administer Piwik Pro" permission could configure the module to load JS from a malicious website. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer piwik pro" to access the settings form where this can be configured. Solution: Install the latest version: * If you use the Piwik Pro module, upgrade to Piwik Pro 1.3.2 [3] Sites are encouraged to review which roles have that permission and which users have that role, to ensure that only trusted users have that permission. Reported By: * Pierre Rudloff (prudloff) [4] Fixed By: * Hartsak (hartsak) [5] * Josha Hubbers (joshahubbers) [6] Coordinated By: * Juraj Nemec (poker10) [7] of the Drupal Security Team * Pierre Rudloff (prudloff) [8] [1] https://www.drupal.org/project/piwik_pro [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/piwik_pro/releases/1.3.2 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/hartsak [6] https://www.drupal.org/u/joshahubbers-0 [7] https://www.drupal.org/u/poker10 [8] https://www.drupal.org/u/prudloff

1 0

Advanced File Destination - Critical - Multiple vulnerabilities - SA-CONTRIB-2025-057
by security-news＠drupal.org 14 May '25

14 May '25

View online: https://www.drupal.org/sa-contrib-2025-057 Project: Advanced File Destination [1] Date: 2025-May-14 Security risk: *Critical* 15 ∕ 25 Critical 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Multiple vulnerabilities Affected versions: * Description: The Advanced File Destination module enhances file upload management in Drupal by allowing users to choose and create custom directories during file uploads. The module has multiple vulnerabilities that were reported through the Drupal Security Team's coordinated vulnerability process. The project maintainer did not follow the terms and conditions for hosting projects on drupal.org that are opted into security coverage, so the module is losing its security coverage. The private issues may be made public at the discretion of the reporter and maintainer. [1] https://www.drupal.org/project/advanced_file_destination [2] https://www.drupal.org/security-team/risk-levels

1 0