Security-news

security-news@drupal.org

1 participants
1782 discussions

SA-CONTRIB-2012-169 - Email Field - Cross Site Scripting and Access bypass
by security-news＠drupal.org 28 Nov '12

28 Nov '12

View online: http://drupal.org/node/1853214 * Advisory ID: DRUPAL-SA-CONTRIB-2012-169 * Project: Email Field [1] (third-party module) * Version: 6.x * Date: 2012-11-28 * Security risk: Less critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting, Access bypass -------- DESCRIPTION --------------------------------------------------------- The email module provides a field type (CCK / FieldAPI) for storing email addresses and a formatter to output the email address as a link to a contact form. The contact form formatter allows a site visitor to email the stored address without letting them see what that e-mail address is. .... Access bypass The module didn't sufficiently check access for the contact form page, allowing a site visitor to email the stored address on the entity without having access to the field itself. This vulnerability is mitigated by needing to to use a field permission module (other than CCK's Content Permissions) with those email fields and need to have the field contact field formatter configured for either full or teaser display modes. CVE: Requested .... Cross Site Scripting Furthermore the mailto link wasn't sanitized when output to the screen. This vulnerability is mitigated by the fact that Drupal's form validation for emails prevents malicious emails and would need to be bypassed to exploit this vulnerability, e.g. by importing data from external sources and not doing validation. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Email Field 6.x-1.x versions prior to 6.x-1.3. Drupal core is not affected. If you do not use the contributed Email Field [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Email Field module for Drupal 6.x, upgrade to Email 6.x-1.4 [4] Also see the Email Field [5] project page. -------- REPORTED BY --------------------------------------------------------- * Fox (hefox) [6] -------- FIXED BY ------------------------------------------------------------ * Matthias Hutterer [7] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Fox (hefox) [8] of the Drupal Security Team * Greg Knaddison [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/email [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/email [4] http://drupal.org/node/1852612 [5] http://drupal.org/project/email [6] http://drupal.org/user/426416 [7] http://drupal.org/user/59747 [8] http://drupal.org/user/426416 [9] http://drupal.org/user/36762 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-168 - Services - Information Disclosure
by security-news＠drupal.org 28 Nov '12

28 Nov '12

View online: http://drupal.org/node/1853200 * Advisory ID: DRUPAL-SA-CONTRIB-2012-168 * Project: Services [1] (third-party module) * Version: 6.x, 7.x * Date: 2012-11-28 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Information Disclosure -------- DESCRIPTION --------------------------------------------------------- This module enables you to access content from a remote client. The module doesn't sufficiently adhere to standard Drupal permissions and exposes users emails via the user index method. This vulnerability is mitigated by the fact that an attacker most know the path to the user resource and must be able to access user profiles (have 'access user profiles' permission). CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Services 6.x-3.x versions prior to 6.x-3.3. * Services 7.x-3.x versions prior to 7.x-3.3. Drupal core is not affected. If you do not use the contributed Services [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Services module for Drupal 6.x, upgrade to Services 6.x-3.3 [4] * If you use the Services module for Drupal 7.x, upgrade to Services 7.x-3.3 [5] Also see the Services [6] project page. -------- REPORTED BY --------------------------------------------------------- * Fox (hefox) [7] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Fox (hefox) [8] of the Drupal Security Team * Kyle Browning [9] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Fox (hefox) [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/services [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/services [4] http://drupal.org/node/1842026 [5] http://drupal.org/node/1842022 [6] http://drupal.org/project/services [7] http://drupal.org/user/426416 [8] http://drupal.org/user/426416 [9] http://drupal.org/user/211387 [10] http://drupal.org/user/426416 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-167 - Mixpanel - Cross site scripting (XSS)
by security-news＠drupal.org 28 Nov '12

28 Nov '12

View online: http://drupal.org/node/1853198 * Advisory ID: DRUPAL-SA-CONTRIB-2012-167 * Project: Mixpanel [1] (third-party module) * Version: 6.x * Date: 2012-November-28 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module provides integration with the Mixpanel real-time analytics service. The module doesn't sufficiently escape the Mixpanel token when adding the tracking Javascript to the page. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access administration pages". CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Mixpanel 6.x-1.x versions prior to 6.x-1.1. Drupal core is not affected. If you do not use the contributed Mixpanel [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Mixpanel module for Drupal 6.x, upgrade to Mixpanel 6.x-1.1 [4] Also see the Mixpanel [5] project page. -------- REPORTED BY --------------------------------------------------------- * David Snopek [6] -------- FIXED BY ------------------------------------------------------------ * wundo [7] the module maintainer * David Snopek [8] -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/mixpanel [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/mixpanel [4] http://drupal.org/node/1852098 [5] http://drupal.org/project/mixpanel [6] http://drupal.org/user/266527 [7] http://drupal.org/user/25523 [8] http://drupal.org/user/266527 [9] http://drupal.org/user/36762 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-166 - Table of Contents - Access Bypass
by security-news＠drupal.org 14 Nov '12

14 Nov '12

View online: http://drupal.org/node/1841046 * Advisory ID: DRUPAL-SA-CONTRIB-2012-166 * Project: Table of Contents [1] (third-party module) * Version: 6.x * Date: 2012-November-14 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- This module enables you to generates a list of select header tags in a box that looks like a table of contents or summary. The links added to that box point to the headers so users can quickly access each section of your documents. The module doesn't sufficiently check for node access restrictions when displaying the table of contents in a block. This vulnerability is mitigated by the fact that an attacker must find a node that is not visible to him/her and yet displays its blocks including the table of contents block. In some Drupal installations, this can happen for unpublished nodes. Also, the attacker will only see the headers (content between H1 to H6 tags) appearing in the table of contents, not the entire page. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * tableofcontents 6.x-3.x versions prior to 6.x-3.8. Drupal core is not affected. If you do not use the contributed Table of Contents [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the table of contents module for Drupal 6.x, upgrade to tableofcontents 6.x-3.8 [4] Also see the Table of Contents [5] project page. -------- REPORTED BY --------------------------------------------------------- * Erik Webb [6] -------- FIXED BY ------------------------------------------------------------ * Erik Webb [7] the reporter * Alexis Wilke [8] the Drupal 6.x maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/tableofcontents [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/tableofcontents [4] http://drupal.org/node/1841026 [5] http://drupal.org/project/tableofcontents [6] http://drupal.org/user/273404 [7] http://drupal.org/user/273404 [8] http://drupal.org/user/356197 [9] http://drupal.org/user/36762 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-165 - Chaos tool suite (ctools) - Cross Site Scripting (XSS)
by security-news＠drupal.org 14 Nov '12

14 Nov '12

View online: http://drupal.org/node/1840992 * Advisory ID: DRUPAL-SA-CONTRIB-2012-165 * Project: Chaos tool suite (ctools) [1] (third-party module) * Version: 6.x * Date: 2012-November-14 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Chaos tool suite is primarily a set of APIs and tools to improve the developer experience. The page manager node view task does not sufficiently escape node titles when setting the page title, allowing XSS. This vulnerability is partially mitigate by the node task being disabled by default and limited to users that have the ability to submit or edit nodes. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Chaos tool suite (ctools) 6.x-1.x versions prior to 6.x-1.10. Drupal core is not affected. If you do not use the contributed Chaos tool suite (ctools) [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Chaos tool suite (ctools) module for Drupal 6.x, upgrade to Chaos tool suite (ctools) 6.x-1.10 [4] Also see the Chaos tool suite (ctools) [5] project page. -------- REPORTED BY --------------------------------------------------------- * Justin KleinKeane [6] * Andrey Tretyakov [7] -------- FIXED BY ------------------------------------------------------------ * Earl Miles (merlinofchaos) [8] -------- COORDINATED BY ------------------------------------------------------ * Klaus Purer [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/ctools [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/ctools [4] http://drupal.org/node/1841030 [5] http://drupal.org/project/ctools [6] http://drupal.org/user/302225 [7] http://drupal.org/user/169459 [8] http://drupal.org/user/26979 [9] http://drupal.org/user/262198 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-164 - Smiley module and Smileys module - Cross Site Scripting (XSS)
by security-news＠drupal.org 14 Nov '12

14 Nov '12

View online: http://drupal.org/node/1840892 * Advisory ID: DRUPAL-SA-CONTRIB-2012-164 * Project: Smiley [1] (third-party module) * Project: Smileys [2] (third-party module) * Version: 6.x * Date: 2012-November-14 * Security risk: Moderately critical [3] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- These modules enable you to substitutes text emoticons, like :-), with images. These modules don't sufficiently sanitize user defined smiley acronyms before displaying smiley images. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer smiley". These two modules are based on the same codebase and Smiley was forked due to lack of new feature development in the Smileys project. This single Security Advisory covers the same issue in the code of both modules. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Smiley 6.x-1.x versions prior to 6.x-1.1. * Smileys 6.x-1.x versions prior to 6.x-1.1. Drupal core is not affected. If you do not use the contributed Smiley [4] module, or the Smileys [5] module there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Smiley module for Drupal 6.x, upgrade to Smiley 6.x-1.1 [6] * If you use the Smileys module for Drupal 6.x, upgrade to Smileys 6.x-1.1 [7] Also see the Smiley [8] project page. -------- REPORTED BY --------------------------------------------------------- * Jimmy Axenhus [9] -------- FIXED BY ------------------------------------------------------------ * Yonas Yanfa [10] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. [1] http://drupal.org/project/smiley [2] http://drupal.org/project/smileys [3] http://drupal.org/security-team/risk-levels [4] http://drupal.org/project/smiley [5] http://drupal.org/project/smileys [6] http://drupal.org/node/1840956 [7] http://drupal.org/node/1840954 [8] http://drupal.org/project/smiley [9] http://drupal.org/user/565562 [10] http://drupal.org/user/473174 [11] http://drupal.org/user/102818 [12] http://drupal.org/contact [13] http://drupal.org/security-team [14] http://drupal.org/writing-secure-code [15] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-162 - RESTful Web Services - Cross site request forgery (CSRF)
by security-news＠drupal.org 14 Nov '12

14 Nov '12

View online: http://drupal.org/node/1840740 * Advisory ID: DRUPAL-SA-CONTRIB-2012-162 * Project: RESTful Web Services [1] (third-party module) * Version: 7.x * Date: 2012-November-14 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Request Forgery -------- DESCRIPTION --------------------------------------------------------- This module enables you to expose Drupal entities as RESTful web services. It provides a machine-readable interface to exchange resources in JSON, XML and RDF. The module doesn't sufficiently verify POST requests thereby exposing a Cross Site Request Forgery vulnerability. This vulnerability is mitigated by the fact that an attacker must trick an authenticated user onto a page with a site-specific malicious HTML form submission. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * RESTWS 7.x-1.x versions prior to 7.x-1.1. * RESTWS 7.x-2.x versions prior to 7.x-2.0-alpha3. Drupal core is not affected. If you do not use the contributed RESTful Web Services [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the RESTWS 1.x module for Drupal 7.x, upgrade to RESTWS 7.x-1.1 [4] * If you use the RESTWS 2.x module for Drupal 7.x, upgrade to RESTWS 7.x-2.0-alpha3 [5] Also see the RESTful Web Services [6] project page. -------- REPORTED BY --------------------------------------------------------- * Damien Tournoud [7] of the Drupal Security Team * Klaus Purer [8] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Klaus Purer [9] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Klaus Purer [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/restws [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/restws [4] http://drupal.org/node/1840722 [5] http://drupal.org/node/1840728 [6] http://drupal.org/project/restws [7] http://drupal.org/user/22211 [8] http://drupal.org/user/262198 [9] http://drupal.org/user/262198 [10] http://drupal.org/user/262198 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-163 - User Read-Only - Permission escalation
by security-news＠drupal.org 14 Nov '12

14 Nov '12

View online: http://drupal.org/node/1840886 * Advisory ID: DRUPAL-SA-CONTRIB-2012-163 * Project: User Read-Only [1] (third-party module) * Version: 6.x, 7.x * Date: 2012-November-14 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- User Read-only is a module that allows an administrator to prevent modification of user account/profile fields. The administrator can select which fields will allow or disallow editing. The module can mistakenly assign roles when performing unrelated operations against a user's account such as changing a password. The vulnerability is particular to certain combinations of configuration and the number of roles available on the site (more than 3). CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * User Read-Only 6.x-1.x versions prior to 6.x-1.4. * User Read-Only 7.x-1.x versions prior to 7.x-1.4. Drupal core is not affected. If you do not use the contributed User Read-Only [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the User Read-Only module for Drupal 6.x, upgrade to User Read-Only 6.x-1.4 [4] * If you use the User Read-Only module for Drupal 7.x, upgrade to User Read-Only 7.x-1.4 [5] Also see the User Read-Only [6] project page. -------- REPORTED BY --------------------------------------------------------- * Kellie Bradford Delaney [7] -------- FIXED BY ------------------------------------------------------------ * David Norman [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [9] of the Drupal Security Team * Heine Deelstra [10] of the Drupal Security Team * Lee Rowlands [11] provisional member of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. [1] http://drupal.org/project/user_readonly [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/user_readonly [4] http://drupal.org/node/1840054 [5] http://drupal.org/node/1840038 [6] http://drupal.org/project/user_readonly [7] http://drupal.org/user/1473110 [8] http://drupal.org/user/972 [9] http://drupal.org/user/36762 [10] http://drupal.org/user/17943 [11] http://drupal.org/user/395439 [12] http://drupal.org/contact [13] http://drupal.org/security-team [14] http://drupal.org/writing-secure-code [15] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-161 - Webform CiviCRM Integration - Access Bypass
by security-news＠drupal.org 07 Nov '12

07 Nov '12

View online: http://drupal.org/node/1834868 * Advisory ID: DRUPAL-SA-CONTRIB-2012-161 * Project: Webform CiviCRM Integration [1] (third-party module) * Version: 7.x * Date: 2012-November-07 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- Webform CiviCRM integration allows you to expose contact data via Webforms. Depending on what fields you have exposed in your form, this may include personal information such as birthdate, phone number, email address, etc. Proper permission settings are important to keep this information from prying eyes. Each "existing contact" on a webform has a setting to enforce CiviCRM permissions -- this setting should rarely be disabled, and only done so by admins who know what they're doing. Unfortunately some circumstances may have led this setting to be incorrectly disabled by the admin: * In version 3.0 - 3.1 of this module, "Enforce Permissions" was not on by default, and needed to be manually selected by the admin. This was fixed in 3.2. * In versions 3.0 - 3.2, the current user could not be autofilled for normal unprivledged users. This may have led some admins to disable the "Enforce Permissions" setting, a dangerous workaround. * In versions 3.0 - 3.3, autofilling a contact via the url with a checksum did not work for anonymous users unless the "Enforce Permissions" setting was disabled. Version 3.4 includes an update script which will automatically set "Enforce Permissions" for all existing contacts to /true/. Once you have upgraded, you may wish to review your webforms and ensure that autofilling contacts works as expected, especially for anonymous users. In a few rare cases where you have established access control through some other means, disabling "Enforce Permissions" may be necessary and you will need to do so manually. CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * Webform CiviCRM Integration 7.x-3.0 to 7.x-3.3 Drupal core is not affected. If you do not use the contributed Webform CiviCRM Integration [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use Webform CiviCRM Integration version 3.x, upgrade to version 3.4 [4] Also see the Webform CiviCRM Integration [5] project page. -------- REPORTED BY --------------------------------------------------------- * Coleman Watts [6] the module maintainer -------- FIXED BY ------------------------------------------------------------ * Coleman Watts [7] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [8] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/webform_civicrm [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/webform_civicrm [4] http://drupal.org/node/1833974 [5] http://drupal.org/project/webform_civicrm [6] http://drupal.org/user/639856 [7] http://drupal.org/user/639856 [8] http://drupal.org/user/36762 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-160 - OM Maximenu - Cross Site Scripting (XSS)
by security-news＠drupal.org 07 Nov '12

07 Nov '12

View online: http://drupal.org/node/1834866 * Advisory ID: DRUPAL-SA-CONTRIB-2012-160 * Project: OM Maximenu [1] (third-party module) * Version: 6.x, 7.x * Date: 2012-November-07 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module enables you to create custom menus with effects and integrate module blocks as it's menu item content. The module doesn't sufficiently state the risk of giving permission to create OM Maximenus. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer OM Maximenu". CVE: Requested -------- VERSIONS AFFECTED --------------------------------------------------- * OM Maximenu 6.x-1.x versions prior to 6.x-1.44. * OM Maximenu 7.x-1.x versions prior to 7.x-1.44. Drupal core is not affected. If you do not use the contributed OM Maximenu [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the OM Maximenu module for Drupal 6.x, upgrade to OM Maximenu 6.x-1.44 [4] * If you use the OM Maximenu module for Drupal 7.x, upgrade to OM Maximenu 7.x-1.44 [5] Also see the OM Maximenu [6] project page. -------- REPORTED BY --------------------------------------------------------- * Justin KleinKeane [7] -------- FIXED BY ------------------------------------------------------------ * Daniel Honrade [8] the module maintainer * Károly Négyesi [9] of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/om_maximenu [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/om_maximenu [4] http://drupal.org/node/1834046 [5] http://drupal.org/node/1834048 [6] http://drupal.org/project/om_maximenu [7] http://drupal.org/user/302225 [8] http://drupal.org/user/351112 [9] http://drupal.org/user/9446 [10] http://drupal.org/user/36762 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news