Security-news

security-news@drupal.org

1 participants
1782 discussions

SA-CONTRIB-2012-032 - Block Class - Cross Site scripting
by security-news＠drupal.org 07 Mar '12

07 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-032 * Project: Block Class [1] (third-party module) * Version: 7.x * Date: 2012-March-07 * Security risk: Moderately Critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The block class module allows users to add classes to any block through the block's configuration interface The class names in a block were not properly filtered. Someone with the ability to modify or create blocks could inject java script that would be rendered when viewing the block. -------- VERSIONS AFFECTED --------------------------------------------------- * Blockclass versions prior to 7.x-1.0. Drupal core is not affected. If you do not use the contributed Block Class [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the block class module for Drupal 7.x, upgrade to block class 7.x-1.1 [4] See also the Block Class [5] project page. -------- REPORTED BY --------------------------------------------------------- * Katherine Senzee [6] -------- FIXED BY ------------------------------------------------------------ * Berend de Boer [7] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [8] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/block_class [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/block_class [4] http://drupal.org/node/1471090 [5] http://drupal.org/project/block_class [6] http://drupal.org/user/139855 [7] http://drupal.org/user/143552 [8] http://drupal.org/user/102818 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-031 - Multiple Modules Unsupported - UC PayDutchGroup - Information leakage and Multisite Search sql injection
by security-news＠drupal.org 07 Mar '12

07 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-031 * Projects: UC PayDutchGroup / WeDeal payment [1], Multisite Search [2] (third-party modules) * Version: 6.x * Date: 2012-March-7 * Security risk: Critical [3] * Exploitable from: Remote * Vulnerability: Information Disclosure -------- DESCRIPTION --------------------------------------------------------- UC PayDutchGroup / WeDeal payment [4] integrates the PayDutchGroup / WeDeal payment gateway with Ubercart. The module exposes account credentials for the store's PayDutchGroup account under certain circumstances allowing a malicious user to login to the PayDutchGroup site as the store owner and manage the store owner's account. The vulnerability is mitigated by an attacker needing to gain an account with the ability to checkout of the store. Multisite Search [5] allows you to index and search content from all sites in a Multisite configuration. The module doesn't sufficiently escape user input when constructing queries. The vulnerability is mitigated by the fact that in order to execute arbitrary sql injection malicious users must have the ability to administer multisite search. -------- VERSIONS AFFECTED --------------------------------------------------- All versions of UC PayDutchGroup / WeDeal payment are affected by vulnerabilities. All versions of Multisite Search payment are affected by vulnerabilities. Drupal core is not affected. If you do not use one of the contributed modules listed above, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Users of thes modules are encouraged to disable the modules and search for similar alternatives. Users of the module who wish to take over maintainership should post patches to the issue queue to fix the security issues and request maintenance following the Unsupported project process [6] -------- REPORTED BY --------------------------------------------------------- * UC PayDutchGroup / WeDeal payment issue reported by Rolf Meijer [7] * Multisite Search issue reported by Justin Klein Keane [8] -------- FIXED BY ------------------------------------------------------------ No fixes created. -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/uc_paydutch [2] http://drupal.org/project/multisite_search [3] http://drupal.org/security-team/risk-levels [4] http://drupal.org/project/uc_paydutch [5] http://drupal.org/project/multisite_search [6] http://drupal.org/node/251466 [7] http://drupal.org/user/358052 [8] http://drupal.org/user/302225 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-030 - Data - Cross Site Scripting (XSS)
by security-news＠drupal.org 07 Mar '12

07 Mar '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-030 * Project: Data [1] (third-party module) * Version: 6.x * Date: 2012-March-07 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module enables you to create arbitrary tables in your Drupal database and manage the data in them, and also manage data in existing tables such as those created by or imported from a third-party application. The module doesn't sufficiently escape the human-readable title that is given to a new table by the admin, thus allowing arbitrary scripts to be run on the site. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer data tables". -------- VERSIONS AFFECTED --------------------------------------------------- * Data 6.x-1.x versions prior to 6.x-1.0. Drupal core is not affected. If you do not use the contributed Data [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Data module for Drupal 6.x, upgrade to Data 6.x-1.1 [4] See also the Data [5] project page. -------- REPORTED BY --------------------------------------------------------- * Justin C. Klein Keane [6] -------- FIXED BY ------------------------------------------------------------ * Joachim Noreiko [7] the module co-maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [8] of the Drupal Security Team * Michael Hess [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/data [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/data [4] http://drupal.org/node/1470980 [5] http://drupal.org/project/data [6] http://drupal.org/user/302225 [7] http://drupal.org/user/107701 [8] http://drupal.org/user/36762 [9] http://drupal.org/user/102818 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-029 - Taxonomy Views Integrator - Cross Site Scripting (XSS)
by security-news＠drupal.org 29 Feb '12

29 Feb '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-029 * Project: Taxonomy Views Integrator (third-party module) * Version: 6.x * Date: 2012-February-29 * Security risk: Moderately critical [1] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Taxonomy Views Integrator allows selective overriding of taxonomy terms and/or vocabulary with the view of your choice. Using TVI you can easily create custom views to output all terms in X vocabulary. The module doesn't sufficiently filter user supplied text on views pages. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer taxonomy". -------- VERSIONS AFFECTED --------------------------------------------------- * Taxonomy Views Integrator 6.x-1.x versions prior to 6.x-1.3. Drupal core is not affected. If you do not use the contributed module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Taxonomy Views Integrator module for Drupal 6.x, upgrade to Taxonomy Views Integrator 6.x-1.3 [2] See also the project page. -------- REPORTED BY --------------------------------------------------------- * Dmitry Trt [3] -------- FIXED BY ------------------------------------------------------------ * Dmitry Trt [4] * Derek Webb [5] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [6] of the Drupal Security Team * Greg Knaddison [7] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [8]. Learn more about the Drupal Security team and their policies [9], writing secure code for Drupal [10], and securing your site [11]. [1] http://drupal.org/security-team/risk-levels [2] http://drupal.org/node/1306946 [3] http://drupal.org/user/329125 [4] http://drupal.org/user/329125 [5] http://drupal.org/user/64114 [6] http://drupal.org/user/102818 [7] http://drupal.org/user/36762 [8] http://drupal.org/contact [9] http://drupal.org/security-team [10] http://drupal.org/writing-secure-code [11] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-028 - Hierarchical Select - Cross Site Scripting (XSS)
by security-news＠drupal.org 29 Feb '12

29 Feb '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-028 * Project: Hierarchical Select [1] (third-party module) * Version: 6.x * Date: 2012-February-29 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Hierarchical Select module provides a "hierarchical_select" form element, which is a greatly enhanced way for letting the user select items in a taxonomy. The module does not sanitize some of the user-supplied data before displaying it, leading to a Cross Site Scripting (XSS [3]) vulnerability that may lead to a malicious user gaining full administrative access. This vulnerability is mitigated by the fact that the attacker must have a role with the 'administer taxonomy' permission; specifically he must be able to create or modify vocabularies and then modify the vocabulary's help text. -------- VERSIONS AFFECTED --------------------------------------------------- * Hierarchical Select 6.x-3.x versions prior to 6.x-3.7. Drupal core is not affected. If you do not use the contributed Hierarchical Select [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Hierarchical Select module for Drupal 6.x, upgrade to Hierarchical Select 6.x-3.8 [5] See also the Hierarchical Select [6] project page. -------- REPORTED BY --------------------------------------------------------- * Sam Oldak [7] * Wim Leers [8] the module maintainer -------- FIXED BY ------------------------------------------------------------ * Wim Leers [9] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Stéphane Corlosquet [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/hierarchical_select [2] http://drupal.org/security-team/risk-levels [3] http://en.wikipedia.org/wiki/Cross-site_scripting [4] http://drupal.org/project/hierarchical_select [5] http://drupal.org/node/1461318 [6] http://drupal.org/project/hierarchical_select [7] http://drupal.org/user/366337 [8] http://drupal.org/user/99777 [9] http://drupal.org/user/99777 [10] http://drupal.org/user/52142 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-027 - Submenu Tree -Cross Site Scripting
by security-news＠drupal.org 29 Feb '12

29 Feb '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-027 * Project: Submenu Tree [1] (third-party module) * Version: 6.x * Date: 2012-February-29 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Submenu Tree module allows sufficiently privileged users to show a list of menu entries when displaying a node. The module does not sanitize some of the user-supplied data before displaying it, leading to a Cross Site Scripting (XSS [3]) vulnerability. The vulnerability is mitigated by the fact that a malicious user must be assigned a role that includes permissions to edit the Drupal menus. -------- VERSIONS AFFECTED --------------------------------------------------- * Submenu Tree versions prior to 6.x-1.5 Drupal core is not affected. If you do not use the contributed Submenu Tree [4] module, there is nothing you need to do. Drupal core is not affected. If you do not use the contributed Submenu Tree [5] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Submenu Tree module upgrade to Submenu Tree 6.x-1.5 [6] Please also see the Submenu Tree project page . See also the Submenu Tree [7] project page. -------- REPORTED BY --------------------------------------------------------- * Kyle Small -------- FIXED BY ------------------------------------------------------------ * Beng Tan [8], module maintainer -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/submenutree [2] http://drupal.org/security-team/risk-levels [3] http://en.wikipedia.org/wiki/Cross-site_scripting [4] http://drupal.org/project/submenutree [5] http://drupal.org/project/submenutree [6] http://drupal.org/node/1132838 [7] http://drupal.org/project/submenutree [8] http://drupal.org/user/132729 [9] http://drupal.org/user/102818 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-026 - ZipCart - Access bypass
by security-news＠drupal.org 29 Feb '12

29 Feb '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-026 * Project: ZipCart [1] (third-party module) * Version: 6.x * Date: 2012-February-29 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- ZipCart [3] enables a site to provide users with Zip archives for downloads selected by the user. Versions of ZipCart prior to 6.x-1.4 checks an incorrect permission when building archives. This vulnerability is mitigated by the fact that archive file addition is only permitted if Drupal's normal file download access check permits the user to download the file directly. -------- VERSIONS AFFECTED --------------------------------------------------- * ZipCart 6.x versions prior to 6.x-1.4 [4]. Drupal core is not affected. If you do not use the contributed ZipCart [5] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the ZipCart module for Drupal 6.x, upgrade to ZipCart 6.x-1.4 [6] See also the ZipCart [7] project page. -------- REPORTED BY --------------------------------------------------------- * Chris Burgess [8] -------- FIXED BY ------------------------------------------------------------ * Chris Burgess [9] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Neil Drumm [10] of the Drupal Security Team * Michael Hess [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. [1] http://drupal.org/project/zipcart [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/zipcart [4] http://drupal.org/node/1460872 [5] http://drupal.org/project/zipcart [6] http://drupal.org/node/1460872 [7] http://drupal.org/project/zipcart [8] http://drupal.org/user/76026 [9] http://drupal.org/user/76026 [10] http://drupal.org/user/3064 [11] http://drupal.org/user/102818 [12] http://drupal.org/contact [13] http://drupal.org/security-team [14] http://drupal.org/writing-secure-code [15] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-025 - Cool aid; Editable help messages - Multiple vulnerabilities
by security-news＠drupal.org 29 Feb '12

29 Feb '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-025 * Project: Cool aid; Editable help messages [1] (third-party module) * Version: 6.x * Date: 2012-February-29 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass, Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- Cool aid is a Drupal module that allows users to add custom help messages to Drupal pages. The module did not properly clean user input before displaying it, and did not properly check for access permissions, allowing users with "administer coolaid" to inject scripts anywhere on a site. -------- VERSIONS AFFECTED --------------------------------------------------- * Cool aid 6.x-1.x prior to 6.x-1.6 Drupal core is not affected. If you do not use the contributed Cool aid; Editable help messages [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Cool aid module for Drupal 6.x, upgrade to Cool aid 6.x-1.9. [4] See also the Cool aid; Editable help messages [5] project page. -------- REPORTED BY --------------------------------------------------------- * Ivo Van Geertruyen [6] -------- FIXED BY ------------------------------------------------------------ * Daniel Braksator [7] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [8] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/coolaid [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/coolaid [4] http://drupal.org/node/1417186 [5] http://drupal.org/project/coolaid [6] http://drupal.org/user/383424 [7] http://drupal.org/user/134005 [8] http://drupal.org/user/102818 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-024 - MediaFront - Cross Site Scripting
by security-news＠drupal.org 29 Feb '12

29 Feb '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-024 * Project: MediaFront [1] (third-party module) * Version: 6.x, 7.x * Date: 2012-February-29 * Security risk: Less Critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- Within the MediaFront module, there is a PHP library for handling the stand alone application of the Open Standard Media player. Within this library, both the $_SESSION and $_SERVER variables are handled without proper checks to make sure that no malicious code is injected within these variables. -------- VERSIONS AFFECTED --------------------------------------------------- * MediaFront 6.x-1.x versions prior to 6.x-1.5. * MediaFront 7.x-1.x versions prior to 7.x-1.5. Drupal core is not affected. If you do not use the contributed MediaFront [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Mediafront module for Drupal 6.x, upgrade to Mediafront 6.x-1.5 [4] * If you use the Mediafront module for Drupal 7.x, upgrade to Mediafront 7.x-1.5 [5] See also the MediaFront [6] project page. -------- REPORTED BY --------------------------------------------------------- * Óscar Estepa [7] -------- FIXED BY ------------------------------------------------------------ * Travis Tidwell [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/mediafront [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/mediafront [4] https://drupal.org/node/1460892 [5] https://drupal.org/node/1460894 [6] http://drupal.org/project/mediafront [7] http://drupal.org/user/1306904 [8] http://drupal.org/user/98581 [9] http://drupal.org/user/102818 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-023 - FAQ - Cross Site Scripting
by security-news＠drupal.org 22 Feb '12

22 Feb '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-023 * Project: Frequently Asked Questions [1] (third-party module) * Version: 6.x * Date: 2012-February-22 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Frequently Asked Questions (faq) module allows users, with the appropriate permissions, to create question and answer pairs which are displayed on the 'faq' page, and in the random and recent FAQ blocks. The module does not sanitize some of the user-supplied data before displaying it, leading to a Cross Site Scripting (XSS [3]) vulnerability. This vulnerability is mitigated by the fact that the attacker must have a role with the 'administer faq', 'create faq', 'edit faq' or 'edit own faq' permissions. If using the FAQ module with the FAQ Ask module, the attacker may also exploit the vulnerability if they have the 'ask question' permission. -------- VERSIONS AFFECTED --------------------------------------------------- * Frequently Asked Questions 6.x-1.x versions prior to 6.x-1.13 [4]. Drupal core is not affected. If you do not use the contributed Frequently Asked Questions [5] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the FAQ module for Drupal 6.x, upgrade to FAQ 6.x-1.13 [6] See also the Frequently Asked Questions [7] project page. -------- REPORTED BY --------------------------------------------------------- * phdruplover [8] -------- FIXED BY ------------------------------------------------------------ * Stella Power [9] the module maintainer and member of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/faq [2] http://drupal.org/security-team/risk-levels [3] http://en.wikipedia.org/wiki/Cross-site_scripting [4] http://drupal.org/node/1451186 [5] http://drupal.org/project/faq [6] http://drupal.org/node/1451186 [7] http://drupal.org/project/faq [8] http://drupal.org/user/1505850 [9] http://drupal.org/user/66894 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news