- Security-news - lists.drupal.org

SA-CONTRIB-2014-087 - Drupal Commerce - Information disclosure
by security-news＠drupal.org 10 Sep '14

10 Sep '14

View online: https://www.drupal.org/node/2336357 * Advisory ID: DRUPAL-SA-CONTRIB-2014-087 * Project: Drupal Commerce [1] (third-party module) * Version: 7.x * Date: 2014-September-10 * Security risk: 13/25 ( Moderately Critical) AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] * Vulnerability: Information Disclosure -------- DESCRIPTION --------------------------------------------------------- Drupal Commerce is used to build eCommerce websites and applications of all sizes. The commerce_order module can be used to create new user accounts where email addresses are used as user names. Since user names are not considered private information in Drupal [3] this is an information disclosure of email addresses. This vulnerability is mitigated by the fact that the commerce_checkout module must be enabled with the default rule configuration enabled that creates new user accounts when an anonymous user completes the checkout process. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [4] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Drupal Commerce 7.x-1.x versions prior to 7.x-1.10. Drupal core is not affected. If you do not use the contributed Drupal Commerce [5] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Drupal Commerce 1.10 includes an update function that will change all user names on the site that look like email addresses. *This can be a disruptive process for some sites and therefore must be enabled explicitly by the update administrator.* If you don't run the default update function you need to make sure yourself that user names are not valid email addresses. To enable the username cleaning update function, you must set the commerce_checkout_run_update_7103 variable to TRUE before running update.php or drush updb: You can either use $conf['commerce_checkout_run_update_7103'] = TRUE; in settings.php or drush vset commerce_checkout_run_update_7103 1. Then install the latest version: * If you use the Drupal Commerce module for Drupal 7.x, upgrade to Drupal Commerce 7.x-1.10 [6] In case you don't want to apply the default update function you can just run update.php without the variable and the update function will be skipped. Also see the Drupal Commerce [7] project page. -------- REPORTED BY --------------------------------------------------------- * Damien Tournoud [8] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Klaus Purer [9] of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * Klaus Purer [10] of the Drupal Security Team * Greg Knaddison [11] of the Drupal Security Team * Ben Jeavons [12] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [13]. Learn more about the Drupal Security team and their policies [14], writing secure code for Drupal [15], and securing your site [16]. [1] https://www.drupal.org/project/commerce [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/1004778 [4] http://cve.mitre.org/ [5] https://www.drupal.org/project/commerce [6] https://www.drupal.org/node/2336327 [7] https://www.drupal.org/project/commerce [8] https://www.drupal.org/user/22211 [9] https://www.drupal.org/user/262198 [10] https://www.drupal.org/user/262198 [11] https://www.drupal.org/user/36762 [12] https://www.drupal.org/user/91990 [13] https://www.drupal.org/contact [14] https://www.drupal.org/security-team [15] https://www.drupal.org/writing-secure-code [16] https://www.drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2014-086 - Custom BreadCrumbs - Cross Site Scripting (XSS)
by security-news＠drupal.org 10 Sep '14

10 Sep '14

View online: https://www.drupal.org/node/2336263 * Advisory ID: DRUPAL-SA-CONTRIB-2014-086 * Project: Custom Breadcrumbs [1] (third-party module) * Version: 6.x, 7.x * Date: 2014-September-10 * Security risk: 16/25 ( Critical) AC:None/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- Custom Breadcrumbs allows administrators to set up parametrized breadcrumb trails for different content types, views, panels, taxonomy vocabularies and terms, paths, and a simple API that allows contributed modules to enable custom breadcrumbs for module pages and theme templates. User input is not properly sanitized in all use cases, opening a Cross Site Scripting (XSS) vulnerability. The vulnerability is only present when the custom breadcrumb is configured with the special identifier so that some of the breadcrumb items are not links. Typical example is that the last breadcrumb element is showing the current page title but is not a link. The XSS vulnerability is not triggered if all items of the breadcrumb are links and special identifier is not used. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Custom Breadcrumbs 6.x-1.x versions prior to 6.x-1.6 * Custom Breadcrumbs 6.x-2.x versions are NOT affected * Custom Breadcrumbs 7.x-2.x versions prior to 7.x-2.0-beta1 Drupal core is not affected. If you do not use the contributed Custom Breadcrumbs [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Custom Breadcrumbs module version 1.x for Drupal 6.x, upgrade to Custom Breadcrumbs 6.x-1.6 [5]. * If you use the Custom Breadcrumbs module version 2.x for Drupal 7.x, upgrade to Custom Breadcrumbs 7.x-2.0-beta1 [6]. Also see the Custom Breadcrumbs [7] project page. -------- REPORTED BY --------------------------------------------------------- * Markus Sipilä [8] -------- FIXED BY ------------------------------------------------------------ * Markus Sipilä [9] * Colan Schwartz [10] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. [1] https://www.drupal.org/project/custom_breadcrumbs [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/custom_breadcrumbs [5] https://www.drupal.org/node/2335705 [6] https://www.drupal.org/node/2335721 [7] https://www.drupal.org/project/custom_breadcrumbs [8] https://www.drupal.org/user/109674 [9] https://www.drupal.org/user/109674 [10] https://www.drupal.org/user/58704 [11] https://www.drupal.org/user/36762 [12] https://www.drupal.org/contact [13] https://www.drupal.org/security-team [14] https://www.drupal.org/writing-secure-code [15] https://www.drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2014-085 - Ubercart - Information disclosure
by security-news＠drupal.org 10 Sep '14

10 Sep '14

View online: https://www.drupal.org/node/2336259 * Advisory ID: DRUPAL-SA-CONTRIB-2014-085 * Project: Ubercart [1] (third-party module) * Version: 7.x * Date: 2014-September-10 * Security risk: 10/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2] * Vulnerability: Information Disclosure -------- DESCRIPTION --------------------------------------------------------- The Ubercart module for Drupal provides a shopping cart and e-commerce features for Drupal. The per-user order history view is not properly protected. This vulnerability is mitigated by the fact that an attacker must have an account with the "view own orders" permission and can only view order IDs, dates, statuses and totals with the default configuration. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Ubercart 7.x-3.x versions prior to 7.x-3.7. Drupal core is not affected. If you do not use the contributed Ubercart [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Ubercart module for Drupal 7.x, upgrade to Ubercart 7.x-3.7 [5] Also see the Ubercart [6] project page. -------- REPORTED BY --------------------------------------------------------- * Silviu CHINGARU [7] -------- FIXED BY ------------------------------------------------------------ * Silviu CHINGARU [8] * Dave Long [9] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] https://www.drupal.org/project/ubercart [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/ubercart [5] https://www.drupal.org/node/2336109 [6] https://www.drupal.org/project/ubercart [7] https://www.drupal.org/user/352564 [8] https://www.drupal.org/user/352564 [9] https://www.drupal.org/user/246492 [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/contact [12] https://www.drupal.org/security-team [13] https://www.drupal.org/writing-secure-code [14] https://www.drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2014-084 - Avatar Uploader - Information Disclosure
by security-news＠drupal.org 03 Sep '14

03 Sep '14

View online: https://www.drupal.org/node/2332169 * Advisory ID: DRUPAL-SA-CONTRIB-2014-84 * Project: Avatar Uploader [1] (third-party module) * Version: 6.x, 7.x * Date: 2014-08-20 * Security risk: 16/25 ( Critical) AC:Basic/A:User/CI:All/II:None/E:Exploit/TD:100 [2] * Vulnerability: Information Disclosure -------- DESCRIPTION --------------------------------------------------------- The Avatar Uploader enables you to upload user pictures in a user-friendly way, like Quora and Facebook. The module doesn't sufficiently check the picture path when a user crops the picture in the uploader panel allowing a malicious user to make specially crafted requests to obtain sensitive server files that are readable by the webserver user. This vulnerability is mitigated by the fact that an attacker must know or guess the relative path out of the temporary directory and to the sensitive files. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Avatar_Uploader 6.x-1.x versions prior to 6.x-1.2 * Avatar_Uploader 7.x-1.x versions prior to 7.x-1.0-beta5 Drupal core is not affected. If you do not use the contributed Avatar Uploader [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Avatar_Uploader module for Drupal 6.x, upgrade to Avatar_Uploader 6.x-1.2 [5] * If you use the Avatar_Uploader module for Drupal 7.x, upgrade to Avatar_Uploader 7.x-1.0-beta6 [6] Also see the Avatar Uploader [7] project page. -------- REPORTED BY --------------------------------------------------------- * Damien Norris [8] -------- FIXED BY ------------------------------------------------------------ * Damien Norris [9] * Greg Knaddison [10] of the Drupal Security Team * Robbin Zhao [11] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [12] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [13]. Learn more about the Drupal Security team and their policies [14], writing secure code for Drupal [15], and securing your site [16]. [1] https://www.drupal.org/project/avatar-uploader [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/avatar-uploader [5] https://www.drupal.org/node/2330763 [6] https://www.drupal.org/node/2330759 [7] https://www.drupal.org/project/avatar-uploader [8] https://www.drupal.org/user/97688 [9] https://www.drupal.org/user/97688 [10] https://www.drupal.org/user/36762 [11] https://www.drupal.org/user/616818 [12] https://www.drupal.org/user/36762 [13] https://www.drupal.org/contact [14] https://www.drupal.org/security-team [15] https://www.drupal.org/writing-secure-code [16] https://www.drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2014-083 - Rules Link - Cross Site Scripting (XSS)
by security-news＠drupal.org 27 Aug '14

27 Aug '14

View online: https://www.drupal.org/node/2328567 * Advisory ID: DRUPAL-SA-CONTRIB-2014-083 * Project: Rules Link [1] (third-party module) * Version: 7.x * Date: 2014-August-27 * Security risk: 9/25 ( Less Critical) AC:Complex/A:Admin/CI:None/II:All/E:Theoretical/TD:25 [2] * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module allows you to create links which trigger arbitrary functionality with the help of the Rules module. The module doesn't sufficiently sanitize the question and description strings when confirmation forms are displayed for triggering Rules links. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer rules links". -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Rules Link 7.x-1.x versions prior to 7.x-1.1. Drupal core is not affected. If you do not use the contributed Rules Link [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Rules Link module for Drupal 7.x, upgrade to Rules Link 7.x-1.1 [5] Also see the Rules Link [6] project page. -------- REPORTED BY --------------------------------------------------------- * Klaus Purer [7] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Klaus Purer [8] of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * Klaus Purer [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] https://www.drupal.org/project/rules_link [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/rules_link [5] https://www.drupal.org/node/2328549 [6] https://www.drupal.org/project/rules_link [7] https://www.drupal.org/user/262198 [8] https://www.drupal.org/user/262198 [9] https://www.drupal.org/user/262198 [10] https://www.drupal.org/contact [11] https://www.drupal.org/security-team [12] https://www.drupal.org/writing-secure-code [13] https://www.drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2014-082 - Marketo MA - Cross Site Scripting (XSS)
by security-news＠drupal.org 20 Aug '14

20 Aug '14

View online: https://www.drupal.org/node/2324813 * Advisory ID: DRUPAL-SA-CONTRIB-2014-082 * Project: Marketo MA [1] (third-party module) * Version: 7.x * Date: 2014-08-20 * Security risk: 8/25 ( Less Critical) AC:Basic/A:Admin/CI:None/II:None/E:Proof/TD:100 [2] * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Marketo MA module adds Marketo marketing automation tracking capability to your website as well as the ability to capture lead data during user registration and via webform integration. It consists of a base module as well as Marketo MA User Webform and Marketo MA User sub-modules. -------- CROSS SITE SCRIPTING ------------------------------------------------ The Marketo MA Webform and Marketo MA User modules included with the Marketo MA module incorrectly print field titles without proper sanitization thereby opening a Cross Site Scripting (XSS) vulnerability. The vulnerability in Marketo MA Webform is mitigated by the fact that an attacker must have a permission which allows them to create Webform fields ("create webform content") and manage their Marketo relationship, ("administer marketo webform settings"). The vulnerability in Marketo MA User is mitigated by the fact that an attacker must have a permission which allows them to create fields (such as "administer users") and manage Marketo MA configuration ("administer marketo"). -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Marketo MA 7.x-1.3 and all earlier version. Drupal core is not affected. If you do not use the contributed Marketo MA [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Marketo MA module for Drupal 7.x, upgrade to Marketo MA 7.x-1.5 [5] Also see the Marketo MA [6] project page. -------- REPORTED BY --------------------------------------------------------- * Matt Vance [7] -------- FIXED BY ------------------------------------------------------------ * Matt Vance [8] * Jeff Yokum [9] the module maintainer * Francisco José Cruz Romanos [10] provisional member of Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * Francisco José Cruz Romanos [11] provisional member of Drupal Security Team * Rick Manelius [12] member of Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [13]. Learn more about the Drupal Security team and their policies [14], writing secure code for Drupal [15], and securing your site [16]. [1] https://www.drupal.org/project/marketo_ma [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/marketo_ma [5] https://www.drupal.org/node/2324777 [6] https://www.drupal.org/project/marketo_ma [7] https://www.drupal.org/user/88338 [8] https://www.drupal.org/user/88338 [9] https://www.drupal.org/user/377457 [10] https://www.drupal.org/user/848238 [11] https://www.drupal.org/user/848238 [12] https://www.drupal.org/user/680072 [13] https://www.drupal.org/contact [14] https://www.drupal.org/security-team [15] https://www.drupal.org/writing-secure-code [16] https://www.drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2014-081 - Site Banner - Cross Site Scripting (XSS)
by security-news＠drupal.org 20 Aug '14

20 Aug '14

View online: https://www.drupal.org/node/2324689 * Advisory ID: DRUPAL-SA-CONTRIB-2014-081 * Project: Site Banner [1] (third-party module) * Version: 7.x * Date: 2014-Aug-20 * Security risk: 12/25 ( Moderately Critical) AC:Complex/A:Admin/CI:Some/II:Some/E:Proof/TD:75 [2] * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Site Banner module enables you to display a banner at the top and bottom of a Drupal site. This module incorrectly prints existing context settings without proper sanitization, opening a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer contexts" from the Context UI module. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Site Banner 7.x-4.x versions prior to 7.x-4.0. * Site Banner 7.x-1.x versions prior to 7.x-1.1. Drupal core is not affected. If you do not use the contributed module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Site Banner module for Drupal 7.x, upgrade to Site Banner 7.x-4.1 [4] Also see the project page. -------- REPORTED BY --------------------------------------------------------- * Matt Vance [5] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Anthony Joseph [6] the module maintainer * Matt Vance [7] of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [8] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] https://www.drupal.org/project/site_banner [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/node/2324303 [5] https://www.drupal.org/user/88338 [6] https://www.drupal.org/user/2543514 [7] https://www.drupal.org/user/88338 [8] https://www.drupal.org/user/36762 [9] https://www.drupal.org/contact [10] https://www.drupal.org/security-team [11] https://www.drupal.org/writing-secure-code [12] https://www.drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2013-080 - Social Stats - Cross Site Scripting (XSS)
by security-news＠drupal.org 20 Aug '14

20 Aug '14

View online: https://www.drupal.org/node/2324681 * Advisory ID: DRUPAL-SA-CONTRIB-2013-080 * Project: Social Stats [1] (third-party module) * Version: 7.x * Date: 2013-August-20 * Security risk: 8/25 ( Less Critical) AC:Basic/A:User/CI:None/II:None/E:Theoretical/TD:100 [2] * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Social Stats module enables you to collect statistics from various social networks and use that data with the Views module as field data, sort criteria, or filter criteria. The module does not sufficiently filter user-supplied text that is stored in the configuration, resulting in a persistent Cross Site Scripting vulnerability (XSS). This vulnerability is mitigated by the fact that an attacker must have a role with the permission "[Content Type]: Create new content". -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Social Stats 7.x-1.x versions prior to 7.x-1.5. Drupal core is not affected. If you do not use the contributed Social Stats [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Social Stats module for Drupal 7.x, upgrade to 7.x-1.5 [5] Also see the Social Stats [6] project page. -------- REPORTED BY --------------------------------------------------------- * Matt Vance [7] -------- FIXED BY ------------------------------------------------------------ * Ajit Shinde [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [9] of the Drupal Security Team * David Stoline [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] https://www.drupal.org/project/social_stats [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/social_stats [5] https://www.drupal.org/node/2323983 [6] https://www.drupal.org/project/social_stats [7] https://www.drupal.org/user/88338 [8] https://www.drupal.org/user/981944 [9] https://www.drupal.org/user/36762 [10] https://www.drupal.org/user/329570 [11] https://www.drupal.org/contact [12] https://www.drupal.org/security-team [13] https://www.drupal.org/writing-secure-code [14] https://www.drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2013-079 - RedHen CRM - Cross Site Scripting (XSS)
by security-news＠drupal.org 20 Aug '14

20 Aug '14

View online: https://www.drupal.org/node/2324679 * Advisory ID: DRUPAL-SA-CONTRIB-2013-079 * Project: RedHen CRM [1] (third-party module) * Version: 7.x * Date: 2013-August-20 * Security risk: 7/25 ( Less Critical) AC:Basic/A:Admin/CI:None/II:None/E:Theoretical/TD:100 [2] * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The RedHen CRM project contains the redhen_dedup module which enables you to find duplicate contacts in the CRM. The redhen_dedup module doesn't sufficiently filter administrator-entered text when deduping contacts as which creates a Cross Site Scripting (XSS) vulnerability. The vulnerability is mitigated by the fact that an attacker needs the permission "administer redhen contacts". -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * RedHen CRM 7.x-1.x versions prior to 7.x-1.8. Drupal core is not affected. If you do not use the contributed RedHen CRM [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the RedHen CRM module for Drupal 7.x, upgrade to RedHen CRM 7.x-1.8 [5] Also see the RedHen CRM [6] project page. -------- REPORTED BY --------------------------------------------------------- * Matt Vance [7] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Lev Tsypin [8] the module maintainer * Matt Vance [9] -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [10] of the Drupal Security Team * David Stoline [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. [1] https://www.drupal.org/project/redhen [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/redhen [5] https://www.drupal.org/node/2324317 [6] https://www.drupal.org/project/redhen [7] https://www.drupal.org/user/88338 [8] https://www.drupal.org/user/54135 [9] https://www.drupal.org/user/88338 [10] https://www.drupal.org/user/36762 [11] https://www.drupal.org/user/329570 [12] https://www.drupal.org/contact [13] https://www.drupal.org/security-team [14] https://www.drupal.org/writing-secure-code [15] https://www.drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2014-78 - Notify - Access bypass
by security-news＠drupal.org 13 Aug '14

13 Aug '14

View online: https://www.drupal.org/node/2320741 * Advisory ID: DRUPAL-SA-CONTRIB-2014-078 * Project: Notify [1] (third-party module) * Version: 7.x * Date: 2014-August-13 * Security risk: 10/25 ( Moderately Critical) AC:Complex/A:User/CI:Some/II:None/E:Proof/TD:75 [2] * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- The notify module allows users to subscribe to periodic emails which include all new or revised content and/or comments of specific content types, much like the daily newsletters sent by some websites. The Notify module does not sufficiently check whether the user has access to recently added or updated nodes and all the fields within the node before including the nodes in notification emails to a given user. This will expose node titles and potentially node teasers and fields to users who should not see them. This vulnerability is mitigated by the fact that a site must use some form of access control and must be configured to include nodes with protected content in notifications. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Notify 7.x-1.0. Drupal core is not affected. If you do not use the contributed Notify [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Notify module for Drupal 7.x, upgrade to Notify 7.x-1.1 [5] Also see the Notify [6] project page. -------- REPORTED BY --------------------------------------------------------- * John Oltman [7] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Gisle Hannemyr [8] one of the module maintainers * Matt Chapman [9] of the Drupal Security Team * John Oltman [10] of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. [1] https://www.drupal.org/project/notify [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/notify [5] https://www.drupal.org/node/2320693 [6] https://www.drupal.org/project/notify [7] https://www.drupal.org/user/699926 [8] https://www.drupal.org/user/409554 [9] https://www.drupal.org/user/143172 [10] https://www.drupal.org/user/699926 [11] https://www.drupal.org/user/36762 [12] https://www.drupal.org/contact [13] https://www.drupal.org/security-team [14] https://www.drupal.org/writing-secure-code [15] https://www.drupal.org/security/secure-configuration

1 0