- Security-news - lists.drupal.org

Dynamic display block - Less Critical - Access bypass - Unsupported - SA-CONTRIB-2015-104
by security-news＠drupal.org 06 May '15

06 May '15

View online: https://www.drupal.org/node/2484157 * Advisory ID: DRUPAL-SA-CONTRIB-2015-104 * Project: Dynamic display block [1] (third-party module) * Version: 7.x * Date: 2015-May-06 * Security risk: 7/25 ( Less Critical) AC:Complex/A:Admin/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- This module enables you to showcase featured content at a prominent place on the front page of the site in an attractive way. The module doesn't sufficiently protect access to content a user has no access to. In certain scenarios a user with the "administer ddblock" permission can see titles of content for which this user has no access. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer ddblock" permission. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- All versions of Dynamic display block module. Drupal core is not affected. If you do not use the contributed Dynamic display block [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ If you use the Dynamic display block module you should uninstall it. Also see the Dynamic display block [5] project page. -------- REPORTED BY --------------------------------------------------------- * David Rothstein [6] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ Not applicable. -------- COORDINATED BY ------------------------------------------------------ * Ben Dougherty [7] provisional member of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [8]. Learn more about the Drupal Security team and their policies [9], writing secure code for Drupal [10], and securing your site [11]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [12] [1] https://www.drupal.org/project/ddblock [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/ddblock [5] https://www.drupal.org/project/ddblock [6] https://www.drupal.org/user/124982 [7] https://www.drupal.org/user/1852732 [8] https://www.drupal.org/contact [9] https://www.drupal.org/security-team [10] https://www.drupal.org/writing-secure-code [11] https://www.drupal.org/security/secure-configuration [12] https://twitter.com/drupalsecurity

1 0

Entityform Block - Moderately Critical - Access Bypass - SA-CONTRIB-2015-106
by security-news＠drupal.org 06 May '15

06 May '15

View online: https://www.drupal.org/node/2484169 * Advisory ID: DRUPAL-SA-CONTRIB-2015-106 * Project: Entityform block [1] (third-party module) * Version: 7.x * Date: 2015-May-06 * Security risk: 12/25 (Moderately Critical) AC:None/A:None/CI:None/II:None/E:Theoretical/TD:All [2] * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- This module enables you to display an entityform as a block. The module doesn't sufficiently check permissions on the entityform under scenarios where the form is locked to a certain role. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Entityform Block 7.x-1.x versions prior to 7.x-1.3. Drupal core is not affected. If you do not use the contributed Entityform block [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Entityform Block module for Drupal 7.x, upgrade to Entityform Block 7.x-1.3 [5] Also see the Entityform block [6] project page. -------- REPORTED BY --------------------------------------------------------- * Niels de Feyter [7] -------- FIXED BY ------------------------------------------------------------ * Tim Whitney [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Rick Manelius [9] of the Drupal Security Team * Aaron Ott [10] Provisional member of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [15] [1] https://www.drupal.org/project/entityform_block [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/entityform_block [5] https://www.drupal.org/node/2483687 [6] https://www.drupal.org/project/entityform_block [7] https://www.drupal.org/user/599438 [8] https://www.drupal.org/u/timodwhit [9] https://www.drupal.org/u/rickmanelius [10] https://www.drupal.org/user/154069 [11] https://www.drupal.org/contact [12] https://www.drupal.org/security-team [13] https://www.drupal.org/writing-secure-code [14] https://www.drupal.org/security/secure-configuration [15] https://twitter.com/drupalsecurity

1 0

Webform Matrix Component - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-107
by security-news＠drupal.org 06 May '15

06 May '15

View online: https://www.drupal.org/node/2484231 * Advisory ID: DRUPAL-SA-CONTRIB-2015-107 * Project: Webform Matrix Component [1] (third-party module) * Version: 7.x * Date: 2015-May-06 * Security risk: 13/25 ( Moderately Critical) AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Webform Matrix Component module is an extension of the Webform module that adds Matrix and Table components. The module doesn't sufficiently sanitize user supplied text, thereby exposing a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to create/edit webform nodes. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Webform Matrix Component 7.x-4.x versions prior to 7.x-4.13. Drupal core is not affected. If you do not use the contributed Webform Matrix Component [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Webform Matrix Component module for Drupal 7.x, upgrade to Webform Matrix Component 7.x-4.13 [5] Also see the Webform Matrix Component [6] project page. -------- REPORTED BY --------------------------------------------------------- * Matt Vance [7] provisional member of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * drupal_rocker [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Rick Manelius [9] of the Drupal Security Team * Pere Orga [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [15] [1] https://www.drupal.org/project/webform_matrix_component [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/webform_matrix_component [5] https://www.drupal.org/node/2442741 [6] https://www.drupal.org/project/webform_matrix_component [7] https://www.drupal.org/user/88338 [8] https://www.drupal.org/user/1493572 [9] https://www.drupal.org/user/680072 [10] https://www.drupal.org/user/2301194 [11] https://www.drupal.org/contact [12] https://www.drupal.org/security-team [13] https://www.drupal.org/writing-secure-code [14] https://www.drupal.org/security/secure-configuration [15] https://twitter.com/drupalsecurity

1 0

Mobile sliding menu - Less Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-108
by security-news＠drupal.org 06 May '15

06 May '15

View online: https://www.drupal.org/node/2484233 * Advisory ID: DRUPAL-SA-CONTRIB-2015-108 * Project: Mobile sliding menu [1] (third-party module) * Version: 7.x * Date: 2015-May-06 * Security risk: 5/25 ( Less Critical) AC:Complex/A:Admin/CI:None/II:None/E:Theoretical/TD:Default [2] * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The mobile sliding menu module integrates the mmenu jQuery plugin for creating slick, app look-alike sliding menus for your mobile website. The module doesn't sufficiently sanitize user supplied text, thereby exposing a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer menu". -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Mobile sliding menu 7.x-2.x versions prior to 7.x-2.1. Drupal core is not affected. If you do not use the contributed Mobile sliding menu [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Mobile sliding menu module for Drupal 7.x, upgrade to Mobile sliding menu 7.x-2.1 [5] Also see the Mobile sliding menu [6] project page. -------- REPORTED BY --------------------------------------------------------- * Mark Jayson Gruta [7] -------- FIXED BY ------------------------------------------------------------ * Mark Jayson Gruta [8] * Jay Chen [9] module maintainer -------- COORDINATED BY ------------------------------------------------------ * Aaron Ott [10] provisional member of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [15] [1] https://www.drupal.org/project/mmenu [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/mmenu [5] https://www.drupal.org/node/2484213 [6] https://www.drupal.org/project/mmenu [7] https://www.drupal.org/user/1121748 [8] https://www.drupal.org/user/1121748 [9] https://www.drupal.org/user/180060 [10] https://www.drupal.org/user/154069 [11] https://www.drupal.org/contact [12] https://www.drupal.org/security-team [13] https://www.drupal.org/writing-secure-code [14] https://www.drupal.org/security/secure-configuration [15] https://twitter.com/drupalsecurity

1 0

Views - Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-103
by security-news＠drupal.org 29 Apr '15

29 Apr '15

View online: https://www.drupal.org/node/2480327 * Advisory ID: DRUPAL-SA-CONTRIB-2015-103 * Project: Views [1] (third-party module) * Version: 7.x * Date: 2015-April-29 * Security risk: 15/25 ( Critical) AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- The Views module provides a flexible method for Drupal site designers to control how lists and tables of content, users, taxonomy terms and other data are presented. .... Access bypass due cache inconsistency Due to an issue in the caching mechanism of Views it's possible that configured filters loose their effect. This can lead to exposure of content that otherwise would be hidden from visitors. This vulnerability is mitigated by the fact that it can't be exploited directly but occurs when certain prerequisites meet. Systems that use in-memory cache backends like redis / memcache are more likely to be affected by this issue. This is due the common strategy used to free cache space if the configured memory limit of the cache is reached. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Views 7.x-3.x versions from 7.x-3.5 to 7.x-3.11. Drupal core is not affected. If you do not use the contributed Views [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Views module for Drupal 7.x, upgrade to Views 7.x-3.11 [5] Also see the Views [6] project page. -------- REPORTED BY --------------------------------------------------------- * Peter Philipp [7] * Daniel Wehner [8]the module maintainer -------- FIXED BY ------------------------------------------------------------ * Peter Philipp [9] -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [15] [1] https://www.drupal.org/project/views [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/views [5] https://www.drupal.org/node/2480259 [6] https://www.drupal.org/project/views [7] https://www.drupal.org/user/762870 [8] https://www.drupal.org/user/99340 [9] https://www.drupal.org/user/762870 [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/contact [12] https://www.drupal.org/security-team [13] https://www.drupal.org/writing-secure-code [14] https://www.drupal.org/security/secure-configuration [15] https://twitter.com/drupalsecurity

1 0

Smart Trim- Less Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-102
by security-news＠drupal.org 29 Apr '15

29 Apr '15

View online: https://www.drupal.org/node/2480321 * Advisory ID: DRUPAL-SA-CONTRIB-2015-102 * Project: Smart Trim [1] (third-party module) * Version: 7.x * Date: 2015-April-29 * Security risk: 5/25 ( Less Critical) AC:Complex/A:Admin/CI:None/II:None/E:Theoretical/TD:Default [2] * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module implements a new field formatter for textfields (text, text_long, and text_with_summary, if you want to get technical) that improves upon the "Summary or Trimmed" formatter built into Drupal 7. The module doesn't sufficiently filter user input via the field settings form. This vulnerability is mitigated by the fact that only administrative users who can administer field types can exploit it. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Smart Trim 7.x-1.x versions prior to 7.x-1.5. Drupal core is not affected. If you do not use the contributed Smart Trim [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the smart_trim module for Drupal 7.x, upgrade to smart_trim-7.x-1.5 [5] Also see the Smart Trim [6] project page. -------- REPORTED BY --------------------------------------------------------- * Tom Lambert [7] -------- FIXED BY ------------------------------------------------------------ * Mark Casias [8] the module maintainer. * Greg Knaddison [9] of the Drupal Security Team. * Damien McKenna [10], provisional member of the Drupal Security Team. -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [11] of the Drupal Security Team. * Damien McKenna [12], provisional member of the Drupal Security Team. -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [13]. Learn more about the Drupal Security team and their policies [14], writing secure code for Drupal [15], and securing your site [16]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [17] [1] https://www.drupal.org/project/smart_trim [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/smart_trim [5] https://www.drupal.org/node/2480289 [6] https://www.drupal.org/project/smart_trim [7] https://www.drupal.org/user/28229 [8] https://www.drupal.org/user/206687 [9] https://www.drupal.org/user/36762 [10] https://www.drupal.org/u/damienmckenna [11] https://www.drupal.org/user/36762 [12] https://www.drupal.org/u/damienmckenna [13] https://www.drupal.org/contact [14] https://www.drupal.org/security-team [15] https://www.drupal.org/writing-secure-code [16] https://www.drupal.org/security/secure-configuration [17] https://twitter.com/drupalsecurity

1 0

MailChimp - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-101
by security-news＠drupal.org 29 Apr '15

29 Apr '15

View online: https://www.drupal.org/node/2480253 * Advisory ID: DRUPAL-SA-CONTRIB-2015-101 * Project: MailChimp [1] (third-party module) * Version: 7.x * Date: 2015-April-29 * Security risk: 11/25 ( Moderately Critical) AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:All [2] * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The MailChimp module allows you to create and manage mailing lists via MailChimp's API. The MailChimp module does not properly sanitize some user input, allowing a malicious user to embed scripts within a page, resulting in a Cross-site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the "administer mailchimp" permission. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * MailChimp 7.x-3.x versions prior to 7.x-3.3. * MailChimp 7.x-2.x all versions. * MailChimp 7.x-1.x all versions. Drupal core is not affected. If you do not use the contributed MailChimp [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the MailChimp module for Drupal 7.x, upgrade to MailChimp 7.x-3.3 [5] Also see the MailChimp [6] project page. -------- REPORTED BY --------------------------------------------------------- * Klaus Purer [7] of the Drupal Security Team * Ide Braakman [8] -------- FIXED BY ------------------------------------------------------------ * Cooper Stimson [9] the module maintainer * Dan Ruscoe [10] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [16] [1] https://www.drupal.org/project/mailchimp [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/mailchimp [5] https://www.drupal.org/node/2480173 [6] https://www.drupal.org/project/mailchimp [7] https://www.drupal.org/user/262198 [8] https://www.drupal.org/user/1879760 [9] https://www.drupal.org/user/2944243 [10] https://www.drupal.org/user/2722087 [11] https://www.drupal.org/u/greggles [12] https://www.drupal.org/contact [13] https://www.drupal.org/security-team [14] https://www.drupal.org/writing-secure-code [15] https://www.drupal.org/security/secure-configuration [16] https://twitter.com/drupalsecurity

1 0

Node Template - Moderately Critical - Cross Site Scripting (XSS) - Unsupported - SA-CONTRIB-2015-099
by security-news＠drupal.org 22 Apr '15

22 Apr '15

View online: https://www.drupal.org/node/2475955 * Advisory ID: DRUPAL-SA-CONTRIB-2015-099 * Project: Node Template [1] (third-party module) * Version: 6.x, 7.x * Date: 2015-April-22 * Security risk: 12/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Default [2] * Vulnerability: Cross Site Request Forgery -------- DESCRIPTION --------------------------------------------------------- Node Template module enables you to define any node as a node template and it can be duplicated later. The module doesn't sufficiently protect some URLs against CSRF. A malicious user can cause a user with "access node template" permission to delete node templates by getting their browser to make a request to a specially-crafted URL. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- All versions of Node Template module. Drupal core is not affected. If you do not use the contributed Node Template [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ If you use the Node Template module you should uninstall it. Also see the Node Template [5] project page. -------- REPORTED BY --------------------------------------------------------- * Pere Orga [6] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ Not applicable. -------- COORDINATED BY ------------------------------------------------------ * Pere Orga [7] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [8]. Learn more about the Drupal Security team and their policies [9], writing secure code for Drupal [10], and securing your site [11]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [12] [1] https://www.drupal.org/project/node_template [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/node_template [5] https://www.drupal.org/project/node_template [6] https://www.drupal.org/user/2301194 [7] https://www.drupal.org/user/2301194 [8] https://www.drupal.org/contact [9] https://www.drupal.org/security-team [10] https://www.drupal.org/writing-secure-code [11] https://www.drupal.org/security/secure-configuration [12] https://twitter.com/drupalsecurity

1 0

HybridAuth Social Login - Less Critical - Information Disclosure - SA-CONTRIB-2015-097
by security-news＠drupal.org 22 Apr '15

22 Apr '15

View online: https://www.drupal.org/node/2475943 * Advisory ID: DRUPAL-SA-CONTRIB-2015-097 * Project: HybridAuth Social Login [1] (third-party module) * Version: 7.x * Date: 2015-April-22 * Security risk: 9/25 ( Less Critical) AC:Basic/A:Admin/CI:Some/II:None/E:Theoretical/TD:Default [2] * Vulnerability: Information Disclosure -------- DESCRIPTION --------------------------------------------------------- HybridAuth Social Login module enables you to allow visitors to authenticate or login to a Drupal site using their identities from social networks like Facebook or Twitter. The module may store user passwords in plain text. This vulnerability is mitigated by the fact that the option "Ask user for a password when registering" must be enabled. The information is disclosed to anyone with access to the database, "administer users" or "administer site configuration" permission. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * HybridAuth Social Login 7.x-2.x versions prior to 7.x-2.10. Drupal core is not affected. If you do not use the contributed HybridAuth Social Login [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the HybridAuth Social Login module for Drupal 7.x, upgrade to HybridAuth Social Login 7.x-2.10 [5] Also see the HybridAuth Social Login [6] project page. -------- REPORTED BY --------------------------------------------------------- * Owen Kelly [7] * Mike Goulding [8] -------- FIXED BY ------------------------------------------------------------ * Owen Kelly [9] * Andrew Berezovsky [10] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Pere Orga [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [16] [1] https://www.drupal.org/project/hybridauth [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/hybridauth [5] https://www.drupal.org/node/2475443 [6] https://www.drupal.org/project/hybridauth [7] https://www.drupal.org/u/ojkelly [8] https://www.drupal.org/u/mikeegoulding [9] https://www.drupal.org/u/ojkelly [10] https://www.drupal.org/u/duozersk [11] https://www.drupal.org/user/2301194 [12] https://www.drupal.org/contact [13] https://www.drupal.org/security-team [14] https://www.drupal.org/writing-secure-code [15] https://www.drupal.org/security/secure-configuration [16] https://twitter.com/drupalsecurity

1 0

Keyword Research - Moderately Critical - Cross Site Request Forgery (CSRF) - SA-CONTRIB-2015-098
by security-news＠drupal.org 22 Apr '15

22 Apr '15

View online: https://www.drupal.org/node/2475953 * Advisory ID: DRUPAL-SA-CONTRIB-2015-098 * Project: Keyword Research [1] (third-party module) * Version: 6.x * Date: 2015-April-22 * Security risk: 13/25 ( Moderately Critical) AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] * Vulnerability: Cross Site Request Forgery -------- DESCRIPTION --------------------------------------------------------- Keyword Research module enables you to tag and prioritize keywords on a site and node level basis. The module doesn't sufficiently protect some URLs against CSRF. A malicious user can cause another user with "kwresearch admin site keywords" permission to create, delete and set priorities to keywords by getting their browser to make a request to a specially-crafted URL. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Keyword Research 6.x-1.x versions prior to 6.x-1.2. Drupal core is not affected. If you do not use the contributed Keyword Research [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Keyword Research module for Drupal 6.x, upgrade to Keyword Research 6.x-1.2 [5] Also see the Keyword Research [6] project page. -------- REPORTED BY --------------------------------------------------------- * Pere Orga [7] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Tom McCracken [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Pere Orga [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [14] [1] https://www.drupal.org/project/kwresearch [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/kwresearch [5] https://www.drupal.org/node/2475591 [6] https://www.drupal.org/project/kwresearch [7] https://www.drupal.org/user/2301194 [8] https://www.drupal.org/user/258411 [9] https://www.drupal.org/user/2301194 [10] https://www.drupal.org/contact [11] https://www.drupal.org/security-team [12] https://www.drupal.org/writing-secure-code [13] https://www.drupal.org/security/secure-configuration [14] https://twitter.com/drupalsecurity

1 0