August 2025 - Security-news - lists.drupal.org

Owl Carousel 2 - Critical - Unsupported - SA-CONTRIB-2025-104
by security-news＠drupal.org 27 Aug '25

27 Aug '25

View online: https://www.drupal.org/sa-contrib-2025-104 Project: Owl Carousel 2 [1] Date: 2025-August-27 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2025-9554 Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [4] [1] https://www.drupal.org/project/owlcarousel2 [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [4] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta…

1 0

API Key manager - Critical - Unsupported - SA-CONTRIB-2025-103
by security-news＠drupal.org 27 Aug '25

27 Aug '25

View online: https://www.drupal.org/sa-contrib-2025-103 Project: API Key manager [1] Date: 2025-August-27 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2025-9553 Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [4] [1] https://www.drupal.org/project/api_key_manager [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [4] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta…

1 0

Synchronize composer.json With Contrib Modules - Critical - Unsupported - SA-CONTRIB-2025-102
by security-news＠drupal.org 27 Aug '25

27 Aug '25

View online: https://www.drupal.org/sa-contrib-2025-102 Project: Synchronize composer.json With Contrib Modules [1] Date: 2025-August-27 Security risk: *Critical* 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * CVE IDs: CVE-2025-9552 Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [4] [1] https://www.drupal.org/project/sync_composer_with_contrib [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [4] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta…

1 0

Protected Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-101
by security-news＠drupal.org 27 Aug '25

27 Aug '25

View online: https://www.drupal.org/sa-contrib-2025-101 Project: Protected Pages [1] Date: 2025-August-27 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <1.8.0 CVE IDs: CVE-2025-9551 Description: This module enables you to protect individual pages with a password. The module doesn't limit the number of password attempts, making it vulnerable to brute force attacks. This vulnerability is mitigated by the fact that an attacker must know the protected page's URL. *CVSS risk score (experimental [3]) 6.3 / Medium* CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N [4] Solution: Install the latest version: * If you use the Protected Pages module for Drupal 8.x, upgrade to Protected Pages 8.x-1.8 [5] Reported By: * Pierre Rudloff (prudloff) [6] Fixed By: * Oksana Cyrwus (oksana-c) [7] * Ra Mänd (ram4nd) [8] Coordinated By: * Benji Fisher (benjifisher) [9] of the Drupal Security Team * Damien McKenna (damienmckenna) [10] of the Drupal Security Team * Greg Knaddison (greggles) [11] of the Drupal Security Team * Drew Webber (mcdruid) [12] of the Drupal Security Team * Juraj Nemec (poker10) [13] of the Drupal Security Team [1] https://www.drupal.org/project/protected_pages [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/securitydrupalorg/issues/3442181 [4] https://www.first.org/cvss/calculator/4-0#CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N… [5] https://www.drupal.org/project/protected_pages/releases/8.x-1.8 [6] https://www.drupal.org/u/prudloff [7] https://www.drupal.org/u/oksana-c [8] https://www.drupal.org/u/ram4nd [9] https://www.drupal.org/u/benjifisher [10] https://www.drupal.org/u/damienmckenna [11] https://www.drupal.org/u/greggles [12] https://www.drupal.org/u/mcdruid [13] https://www.drupal.org/u/poker10

1 0

Facets - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-100
by security-news＠drupal.org 27 Aug '25

27 Aug '25

View online: https://www.drupal.org/sa-contrib-2025-100 Project: Facets [1] Date: 2025-August-27 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Affected versions: <2.0.10 || >=3.0.0 <3.0.1 CVE IDs: CVE-2025-9549 Description: This module enables you to to easily create and manage faceted search interfaces. The module doesn’t sufficiently filter certain user-provided text leading to a cross site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission “administer facets”. *CVSS risk score (experimental [3]) 4.8 / Medium* CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:L/VA:N/SC:L/SI:N/SA:N [4] Solution: Install the latest version: * If you use the Facets module for Drupal 8.x or higher, upgrade to Facets 2.0.10 [5] or Facets 3.0.1 [6] Reported By: * Pierre Rudloff (prudloff) [7] Fixed By: * Joris Vercammen (borisson_) [8] * Thomas Seidl (drunken monkey) [9] * Pierre Rudloff (prudloff) [10], provisional member of the Drupal Security Team Coordinated By: * Damien McKenna (damienmckenna) [11] of the Drupal Security Team * Ivo Van Geertruyen (mr.baileys) [12] of the Drupal Security Team * Pierre Rudloff (prudloff) [13], provisional member of the Drupal Security Team * Drew Webber (mcdruid) [14] of the Drupal Security Team [1] https://www.drupal.org/project/facets [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/securitydrupalorg/issues/3442181 [4] https://www.first.org/cvss/calculator/4-0#CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P… [5] https://www.drupal.org/project/facets/releases/2.0.10 [6] https://www.drupal.org/project/facets/releases/3.0.1 [7] https://www.drupal.org/u/prudloff [8] https://www.drupal.org/u/borisson_ [9] https://www.drupal.org/u/drunken-monkey [10] https://www.drupal.org/u/prudloff [11] https://www.drupal.org/u/damienmckenna [12] https://www.drupal.org/u/mrbaileys [13] https://www.drupal.org/u/prudloff [14] https://www.drupal.org/u/mcdruid

1 0

Facets - Moderately critical - Information Disclosure - SA-CONTRIB-2025-099
by security-news＠drupal.org 27 Aug '25

27 Aug '25

View online: https://www.drupal.org/sa-contrib-2025-099 Project: Facets [1] Date: 2025-August-27 Security risk: *Moderately critical* 11 ∕ 25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Information Disclosure Affected versions: <2.0.10 || >=3.0.0 <3.0.1 CVE IDs: CVE-2025-9549 Description: This module enables you to to easily create and manage faceted search interfaces. The module doesn't sufficiently check access to entities when they are displayed as facets. This vulnerability is mitigated by the fact that only sites that show facets with entity labels (like taxonomy terms) are affected, and only if some of those entities are unpublished or have other access restrictions. *CVSS risk score (experimental [3]) 6.9 / Medium* CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N [4] Solution: Install the latest version: * If you use the Facets module for Drupal 8.x or higher, upgrade to Facets 2.0.10 [5] or Facets 3.0.1 [6] Reported By: * Damien McKenna (damienmckenna) [7] of the Drupal Security Team Fixed By: * Benji Fisher (benjifisher) [8] of the Drupal Security Team * Joris Vercammen (borisson_) [9] * Damien McKenna (damienmckenna) [10] of the Drupal Security Team * Thomas Seidl (drunken monkey) [11] * Jimmy Henderickx (strykaizer) [12] Coordinated By: * Benji Fisher (benjifisher) [13] of the Drupal Security Team * Damien McKenna (damienmckenna) [14] of the Drupal Security Team * Greg Knaddison (greggles) [15] of the Drupal Security Team * Drew Webber (mcdruid) [16] of the Drupal Security Team * Cathy Theys (yesct) [17] of the Drupal Security Team [1] https://www.drupal.org/project/facets [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/securitydrupalorg/issues/3442181 [4] https://www.first.org/cvss/calculator/4-0#CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N… [5] https://www.drupal.org/project/facets/releases/2.0.10 [6] https://www.drupal.org/project/facets/releases/3.0.1 [7] https://www.drupal.org/u/damienmckenna [8] https://www.drupal.org/u/benjifisher [9] https://www.drupal.org/u/borisson_ [10] https://www.drupal.org/u/damienmckenna [11] https://www.drupal.org/u/drunken-monkey [12] https://www.drupal.org/u/strykaizer [13] https://www.drupal.org/u/benjifisher [14] https://www.drupal.org/u/damienmckenna [15] https://www.drupal.org/u/greggles [16] https://www.drupal.org/u/mcdruid [17] https://www.drupal.org/u/yesct

1 0

Authenticator Login - Moderately critical - Access bypass - SA-CONTRIB-2025-098
by security-news＠drupal.org 27 Aug '25

27 Aug '25

View online: https://www.drupal.org/sa-contrib-2025-098 Project: Authenticator Login [1] Date: 2025-August-27 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <2.1.8 CVE IDs: CVE-2025-8093 Description: This module allows users to setup two-factor authentication (2FA) using authenticator apps for enhanced login security. The module did not protect all possible login paths provided by core modules. *CVSS risk score (experimental [3]) 6.3 / Medium* CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N [4] Solution: Install the latest version: * If you use the Alogin module for Drupal 10^, upgrade to Alogin 2.1.8 [5] Reported By: * Pierre Rudloff (prudloff) [6] Fixed By: * Ahmed Raza (ahmed.raza) [7] * Pierre Rudloff (prudloff) [8], provisional member of the Drupal Security Team Coordinated By: * Damien McKenna (damienmckenna) [9] of the Drupal Security Team * Greg Knaddison (greggles) [10] of the Drupal Security Team * Drew Webber (mcdruid) [11] of the Drupal Security Team * Juraj Nemec (poker10) [12] of the Drupal Security Team * Cathy Theys (yesct) [13] of the Drupal Security Team [1] https://www.drupal.org/project/alogin [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/securitydrupalorg/issues/3442181 [4] https://www.first.org/cvss/calculator/4-0#CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N… [5] https://www.drupal.org/project/alogin/releases/2.1.8 [6] https://www.drupal.org/u/prudloff [7] https://www.drupal.org/u/ahmedraza [8] https://www.drupal.org/u/prudloff [9] https://www.drupal.org/u/damienmckenna [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/mcdruid [12] https://www.drupal.org/u/poker10 [13] https://www.drupal.org/u/yesct

1 0

Layout Builder Advanced Permissions - Moderately critical - Access bypass - SA-CONTRIB-2025-097
by security-news＠drupal.org 13 Aug '25

13 Aug '25

View online: https://www.drupal.org/sa-contrib-2025-097 Project: Layout Builder Advanced Permissions [1] Date: 2025-August-13 Security risk: *Moderately critical* 10 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: 2.2.0 CVE IDs: CVE-2025-8996 Description: The Layout Builder Advanced Permissions module enables you to have fine grained control over who can do what in editing pages built with Layout Builder. The module doesn't sufficiently control access for adding sections in the submodule. This vulnerability is mitigated by the fact that an attacker must have a role with a specific set of permissions: * Node: View published content * Node: (Your content type): Create new content * Node: (Your content type): Edit any content * Layout builder: (Your content type): Configure layout overrides for content items that the user can edit * Layout builder advanced permissions: Access Layout Builder page Solution: Install the latest version: * If you use the Layout Builder Advanced Permissions module, upgrade to Layout Builder Advanced Permissions 2.2.1 [3] Reported By: * Eelke Blok (eelkeblok) [4] * Michael Whittaker (mrwhittaker) [5] Fixed By: * Eelke Blok (eelkeblok) [6] * Sorin Dediu (sdstyles) [7] * Sean Blommaert (seanb) [8] Coordinated By: * Anna Kalata (akalata) [9] * Damien McKenna (damienmckenna) [10] of the Drupal Security Team * Greg Knaddison (greggles) [11] of the Drupal Security Team * Juraj Nemec (poker10) [12] of the Drupal Security Team * Cathy Theys (yesct) [13] of the Drupal Security Team [1] https://www.drupal.org/project/layout_builder_perms [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/layout_builder_perms/releases/2.2.1 [4] https://www.drupal.org/u/eelkeblok [5] https://www.drupal.org/u/mrwhittaker [6] https://www.drupal.org/u/eelkeblok [7] https://www.drupal.org/u/sdstyles [8] https://www.drupal.org/u/seanb [9] https://www.drupal.org/u/akalata [10] https://www.drupal.org/u/damienmckenna [11] https://www.drupal.org/u/greggles [12] https://www.drupal.org/u/poker10 [13] https://www.drupal.org/u/yesct

1 0

Authenticator Login - Highly critical - Access bypass - SA-CONTRIB-2025-096
by security-news＠drupal.org 13 Aug '25

13 Aug '25

View online: https://www.drupal.org/sa-contrib-2025-096 Project: Authenticator Login [1] Date: 2025-August-13 Security risk: *Highly critical* 21 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Proof/TD:All [2] Vulnerability: Access bypass Affected versions: <2.1.4 CVE IDs: CVE-2025-8995 Description: This module enables users to setup two-factor authentication (2FA) using authenticator apps for enhanced login security. The module alters the standard Drupal login form to use AJAX callbacks for handling authentication flow. The module doesn't sufficiently validate authentication under specific conditions, allowing an attacker to log in as any account where they know the username. This vulnerability is mitigated by the fact that an attacker must make a series of requests to trigger the necessary conditions that allow authentication byass. The series of requests could alert a site owner that they are being attacked; however, the number of requests necessary to trigger the conditions is usually quite small (the number depends on site configuration, by default it is 5). Solution: Install the latest version: * If you use the alogin module for Drupal 10^, upgrade to the latest version or at least Alogin 2.1.5 [3] /Note: the fix is in a tag in git for 2.1.4 however there is no release for that tag. The fix is also in 2.1.5 relase./ Reported By: * Pierre Rudloff (prudloff) [4] Fixed By: * Ahmed Raza (ahmed.raza) [5] Coordinated By: * Damien McKenna (damienmckenna) [6] of the Drupal Security Team * Dan Smith (galooph) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Cathy Theys (yesct) [9] of the Drupal Security Team [1] https://www.drupal.org/project/alogin [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/alogin/releases/2.1.5 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/ahmedraza [6] https://www.drupal.org/u/damienmckenna [7] https://www.drupal.org/u/galooph [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/yesct

1 0

AI SEO Link Advisor - Less critical - Server-side Request Forgery - SA-CONTRIB-2025-095
by security-news＠drupal.org 06 Aug '25

06 Aug '25

View online: https://www.drupal.org/sa-contrib-2025-095 Project: AI SEO Link Advisor [1] Date: 2025-August-06 Security risk: *Less critical* 8 ∕ 25 AC:Basic/A:User/CI:None/II:None/E:Theoretical/TD:All [2] Vulnerability: Server-side Request Forgery Affected versions: <1.0.6 CVE IDs: CVE-2025-8675 Description: This module enables you to provide SEO analysis and recommendations for a given URL. The module doesn't sufficiently sanitize user-supplied URLs, leading to a Server-side request forgery (SSRF) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access seo analyzer". Solution: Install the latest version: * If you use the AI SEO Link Advisor module 1.0.x, upgrade to AI SEO Link Advisor 1.0.6 [3] Reported By: * Alberto Cocchiara (bigbabert) [4] * Conrad Lara (cmlara) [5] Fixed By: * Alberto Cocchiara (bigbabert) [6] * Conrad Lara (cmlara) [7] * Vishal Kadam (vishal.kadam) [8] Coordinated By: * Benji Fisher (benjifisher) [9] of the Drupal Security Team * catch (catch) [10] of the Drupal Security Team * Damien McKenna (damienmckenna) [11] of the Drupal Security Team * Greg Knaddison (greggles) [12] of the Drupal Security Team [1] https://www.drupal.org/project/ai_seo_link_advisor [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ai_seo_link_advisor/releases/1.0.6 [4] https://www.drupal.org/u/bigbabert [5] https://www.drupal.org/u/cmlara [6] https://www.drupal.org/u/bigbabert [7] https://www.drupal.org/u/cmlara [8] https://www.drupal.org/u/vishalkadam [9] https://www.drupal.org/u/benjifisher [10] https://www.drupal.org/u/catch [11] https://www.drupal.org/u/damienmckenna [12] https://www.drupal.org/u/greggles

1 0