Security-news

security-news@drupal.org

1 participants
1782 discussions

SA-CONTRIB-2012-004 - Date - SQL injection
by security-news＠drupal.org 11 Jan '12

11 Jan '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-004 * Project: Date [1] (third-party module) * Version: 6.x * Date: 2012-January-11 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: SQL Injection -------- DESCRIPTION --------------------------------------------------------- This module enables you to add and administer date fields to nodes. It includes Date Tools, that allows users to convert nodes created with the Event module into Date fields. The conversion form for Events is vulnerable to SQL injection. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer Date Tools", and the option is only available on sites which have used the Event module in the past and have the Event table in the database. -------- VERSIONS AFFECTED --------------------------------------------------- * Date 6.x-2.x versions prior to 6.x-2.8. Drupal core is not affected. If you do not use the contributed Date [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Date module for Drupal 6.x, upgrade to Date 6.x-2.8 [4] See also the Date [5] project page. -------- REPORTED BY --------------------------------------------------------- * Greg Knaddison [6], Drupal security team member -------- FIXED BY ------------------------------------------------------------ * Karen Stevenson [7], the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [8], Drupal security team member -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/date [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/date [4] http://drupal.org/node/1401026 [5] http://drupal.org/project/date [6] http://drupal.org/user/36762 [7] http://drupal.org/user/45874 [8] http://drupal.org/user/102818 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-003 - Fill PDF - Multiple Vulnerabilities
by security-news＠drupal.org 04 Jan '12

04 Jan '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-003 * Project: Fill PDF [1] (third-party module) * Version: 6.x, 7.x * Date: 2012-JANUARY-04 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass, Arbitrary code execution -------- DESCRIPTION --------------------------------------------------------- This module enables you to populate fillable PDF templates with data from nodes and webforms. .... Access bypass (7.x only) Incorrectly-ordered arguments in a call to the function that handles the main functionality of the module makes it possible for an attacker to trigger /any/ PDF to be filled, regardless of whether they have access to the node/webform or not, by passing an appropriately-formed query string argument. This vulnerability is mitigated by the fact that an attacker can only access configured PDF templates, that the attacker must know (or brute-force) the node or webform IDs, and that only information that is configured to be filled into the PDFs (and the filled PDF templates themselves) can be obtained through this exploit. .... Arbitrary code execution (6.x and 7.x) The template importing and exporting used serialized PHP which required the use of an unsafe PHP function to evaluate and import templates, which could lead to execution of unwanted and untrusted code. This vulnerability is mitigated by the fact that the attacker must have the 'administer PDFs' permission. -------- VERSIONS AFFECTED --------------------------------------------------- * Fill PDF 6.x-1.x versions prior to 6.x-1.16. * Fill PDF 7.x-1.x versions prior to 7.x-1.2. Drupal core is not affected. If you do not use the contributed Fill PDF [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Fill PDF module for Drupal 6.x, upgrade to Fill PDF 6.x-1.16 [4]. * If you use the Fill PDF module for Drupal 7.x, upgrade to Fill PDF 7.x-1.2 [5]. See also the Fill PDF [6] project page. -------- REPORTED BY --------------------------------------------------------- * Access bypass reported by Christian Johansson [7] * Arbitrary code execution reported by Liam Morland [8] -------- FIXED BY ------------------------------------------------------------ * Kevin Kaland (wizonesolutions) [9], module maintainer * Arbitrary code execution fixed by Liam Morland [10] -------- COORDINATED BY ------------------------------------------------------ * Dave Reid [11], Drupal Security team member -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. [1] http://drupal.org/project/fillpdf [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/fillpdf [4] http://drupal.org/node/1394070 [5] http://drupal.org/node/1394066 [6] http://drupal.org/project/fillpdf [7] http://drupal.org/user/204187 [8] http://drupal.org/user/493050 [9] http://drupal.org/user/739994 [10] http://drupal.org/user/493050 [11] http://drupal.org/user/53892 [12] http://drupal.org/contact [13] http://drupal.org/security-team [14] http://drupal.org/writing-secure-code [15] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-002 - Lingotek Cross Site Scripting
by security-news＠drupal.org 04 Jan '12

04 Jan '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-002 * Project: Lingotek Collaborative Translation [1] (third-party module) * Version: 6.x * Date: 2012-January-04 * Security risk: Critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module enables you to translate a website's content using tools provided by the Lingotek Collaborative Translation Network. The module doesn't sufficiently sanitize user input when creating or editing page content. This allows a malicious content editor to potentially input malicious code (e.g. Javascript) to create a persistent Cross Site Scripting (XSS) attack. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to edit or create node content types. -------- VERSIONS AFFECTED --------------------------------------------------- * Lingotek [3] 6.x-1.x versions prior to 6.x-1.4. Drupal core is not affected. If you do not use the contributed Lingotek Collaborative Translation [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Lingotek module for Drupal 6.x, upgrade to Lingotek 6.x-1.4 [5]. See also the Lingotek Collaborative Translation [6] project page. -------- REPORTED BY --------------------------------------------------------- * Ezra Barnett Gildesgame [7] -------- FIXED BY ------------------------------------------------------------ * Steven Blatnick [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Forest Monsen [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/lingotek [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/lingotek [4] http://drupal.org/project/lingotek [5] http://drupal.org/node/1394186 [6] http://drupal.org/project/lingotek [7] http://drupal.org/user/69959 [8] http://drupal.org/user/1525084 [9] http://drupal.org/user/181798 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2012-001 - Registration Codes - Access bypass
by security-news＠drupal.org 04 Jan '12

04 Jan '12

* Advisory ID: DRUPAL-SA-CONTRIB-2012-001 * Project: Registration Codes (third-party module) * Version: 6.x * Date: 2012-January-04 * Security risk: Critical * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- The Registration Codes module enables site administrators to restrict registration for new accounts to only users who provide a valid registration code. The default module installation provides no access check for the registration code list, leading to a vulnerability that allows unauthenticated members to easily view the registration code list. -------- VERSIONS AFFECTED --------------------------------------------------- * Registration Codes module for Drupal 6.x versions prior to 6.x-2.4 Drupal core is not affected. If you do not use the contributed Registration Codes [1] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Registration Codes module for Drupal 6.x upgrade to Registration codes 6.x-2.4 [2] or later. -------- REPORTED BY --------------------------------------------------------- * Thomas Bonte (toemaz) [3] -------- FIXED BY ------------------------------------------------------------ * Aidan Lister (aidanlis) [4], module maintainer -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the form at http://drupal.org/contact. Learn more about the team and their policies [5], writing secure code for Drupal [6], and secure configuration [7] of your site. [1] http://drupal.org/project/regcode [2] http://drupal.org/node/877992 [3] http://drupal.org/user/19502 [4] http://drupal.org/user/502018 [5] http://drupal.org/security-team [6] http://drupal.org/writing-secure-code [7] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-059 - Meta tags quick - Cross Site Scripting (XSS)
by security-news＠drupal.org 14 Dec '11

14 Dec '11

-------- DESCRIPTION --------------------------------------------------------- The Meta tags quick module provides a simple tool to add meta tags to a site. The module doesn't consistently filter user input which could lead to a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer content types", "administer vocabularies and terms" or another permission that allows modifying the names of entity bundles. -------- VERSIONS AFFECTED --------------------------------------------------- * Meta tags quick 7.x-2.x versions prior to 7.x-2.3. Drupal core is not affected. If you do not use the contributed Meta tags quick [1] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Meta tags quick module for Drupal 7.x, upgrade to Meta tags quick 7.x-2.3 [2]. See also the Meta tags quick [3] project page. -------- REPORTED BY --------------------------------------------------------- * Michael Smith [4] -------- FIXED BY ------------------------------------------------------------ * Michael Smith [5] * valthebald [6] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Dave Reid [7] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [8]. Learn more about the Drupal Security team and their policies [9], writing secure code for Drupal [10], and securing your site [11]. [1] http://drupal.org/project/metatags_quick [2] http://drupal.org/node/1370878 [3] http://drupal.org/project/metatags_quick [4] http://drupal.org/user/1291584 [5] http://drupal.org/user/1291584 [6] http://drupal.org/user/239562 [7] http://drupal.org/user/53892 [8] http://drupal.org/contact [9] http://drupal.org/security-team [10] http://drupal.org/writing-secure-code [11] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-057 - Support Ticketing System - Cross Site Scripting (XSS)
by security-news＠drupal.org 30 Nov '11

30 Nov '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-057 * Project: Support Ticketing System [1] (third-party module) * Version: 6.x * Date: 2011-November-30 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Support Ticketing System module provides a basic ticketing system and helpdesk that is native to Drupal, offering complete email integration. The module does not properly sanitize user-supplied content, resulting in multiple Cross-Site Scripting (XSS) vulnerabilities. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer support projects." -------- VERSIONS AFFECTED --------------------------------------------------- * support 6.x-1.x versions prior to 6.x-1.7 [3]. Drupal core is not affected. If you do not use the contributed Support Ticketing System [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Support Ticketing System module for Drupal 6.x, upgrade to support 6.x-1.7 [5] Note: If you were using the 6.x-1.6-rc1 release, or wish to test the latest 6.x version, you may upgrade to support 6.x-1.8-rc1 [6]. See also the Support Ticketing System [7] project page. -------- REPORTED BY --------------------------------------------------------- * Brandon Bergren [8] -------- FIXED BY ------------------------------------------------------------ * Brandon Bergren [9] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/support [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/node/1357300 [4] http://drupal.org/project/support [5] http://drupal.org/node/1357300 [6] http://drupal.org/node/1357304 [7] http://drupal.org/project/support [8] http://drupal.org/user/53081 [9] http://drupal.org/user/53081 [10] http://drupal.org/user/36762 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-058 - Support Timer - Cross Site Scripting (XSS)
by security-news＠drupal.org 30 Nov '11

30 Nov '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-058 * Project: Support Timer [1] (third-party module) * Version: 6.x * Date: 2011-November-30 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Support Timer module adds a javascript-based timer to the Support Ticketing System [3] for tracking how long users are working on support tickets, as well as administrative reports. The module does not properly sanitize user-supplied content, resulting in multiple Cross-Site Scripting (XSS) vulnerabilities. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "track time spent". -------- VERSIONS AFFECTED --------------------------------------------------- * Support Timer 6.x-1.x versions prior to 6.x-1.4 [4]. Drupal core is not affected. If you do not use the contributed Support Timer [5] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Support Timer module for Drupal 6.x, upgrade to Support Timer 6.x-1.4 [6] See also the Support Timer [7] project page. -------- REPORTED BY --------------------------------------------------------- * Brandon Bergren [8] -------- FIXED BY ------------------------------------------------------------ * Brandon Bergren [9] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Greg Knaddison [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. [1] http://drupal.org/project/support_timer [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/support [4] http://drupal.org/node/1357278 [5] http://drupal.org/project/support_timer [6] http://drupal.org/node/1357278 [7] http://drupal.org/project/support_timer [8] http://drupal.org/user/53081 [9] http://drupal.org/user/53081 [10] http://drupal.org/user/36762 [11] http://drupal.org/contact [12] http://drupal.org/security-team [13] http://drupal.org/writing-secure-code [14] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-056 - Webform Validation Cross Site Scripting
by security-news＠drupal.org 30 Nov '11

30 Nov '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-056 * Project: Webform Validation [1] (third-party module) * Version: 6.x, 7.x * Date: 2011-November-30 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Webform Validation module enables you to add form validation rules to Webform components through a UI. The module contains multiple cross site scripting (XSS) vulnerabilities due to the fact that it fails to sanitize certain user entered text prior to displaying in the browser. This vulnerability is mitigated by the fact that an attacker must have a role with permission to update Webform nodes. Various permissions provide for this ability. -------- VERSIONS AFFECTED --------------------------------------------------- * Webform Validation 6.x-1.x versions prior to 6.x-1.4. * Webform Validation 7.x-1.x versions prior to 7.x-1.0. Drupal core is not affected. If you do not use the contributed Webform Validation [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Webform Validation module for Drupal 6.x, upgrade to Webform Validation 6.x-1.5 [4] * If you use the Webform Validation module for Drupal 7.x, upgrade to Webform Validation 7.x-1.1 [5] See also the Webform Validation [6] project page. -------- REPORTED BY --------------------------------------------------------- * Justin_KleinKeane [7] -------- FIXED BY ------------------------------------------------------------ * Sven Decabooter [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Forest Monsen [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. [1] http://drupal.org/project/webform_validation [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/webform_validation [4] http://drupal.org/node/1357354 [5] http://drupal.org/node/1357356 [6] http://drupal.org/project/webform_validation [7] http://drupal.org/user/302225 [8] http://drupal.org/user/35369 [9] http://drupal.org/user/181798 [10] http://drupal.org/contact [11] http://drupal.org/security-team [12] http://drupal.org/writing-secure-code [13] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-055 - Webform CiviCRM Integration - Multiple vulnerabilities
by security-news＠drupal.org 09 Nov '11

09 Nov '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-055 * Project: Webform CiviCRM Integration [1] (third-party module) * Version: 6.x, 7.x * Date: 2011-November-09 * Security risk: Moderately critical [2] * Exploitable from: Remote * Vulnerability: Access bypass, SQL Injection -------- DESCRIPTION --------------------------------------------------------- The Webform CiviCRM Integration module extends the functionality of the Webform Module [3] to link form submissions with a CiviCRM [4] database. Version 2.0 of the module added form validation based on CiviCRM data type. A flaw in the implementation of this feature caused other validation handlers to fail, so the Webform would be able to be submitted even if required fields were left blank, etc. Version 2.1 fixed this issue, but implemented validation in such a way as to leave a possible opening for SQL injection. Both issues are now fixed in version 2.2. -------- VERSIONS AFFECTED --------------------------------------------------- * Webform CiviCRM Integration prior to 6.x-2.2 * Webform CiviCRM Integration prior to 7.x-2.2 Drupal core is not affected. If you do not use the contributed Webform CiviCRM Integration [5] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the module for Drupal 6.x, upgrade to Webform CiviCRM Integration 6.x-2.2 [6] * If you use the module for Drupal 7.x, upgrade to Webform CiviCRM Integration 7.x-2.2 [7] See also the Webform CiviCRM Integration [8] project page. -------- REPORTED BY --------------------------------------------------------- * Michał Mach [9] -------- FIXED BY ------------------------------------------------------------ * Coleman Watts [10] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Stéphane Corlosquet [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. [1] http://drupal.org/project/webform_civicrm [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/webform [4] http://civicrm.org [5] http://drupal.org/project/webform_civicrm [6] http://drupal.org/node/1336044 [7] http://drupal.org/node/1336046 [8] http://drupal.org/project/webform_civicrm [9] http://drupal.org/user/765720 [10] http://drupal.org/user/639856 [11] http://drupal.org/user/52142 [12] http://drupal.org/contact [13] http://drupal.org/security-team [14] http://drupal.org/writing-secure-code [15] http://drupal.org/security/secure-configuration

1 0

SA-CONTRIB-2011-054 - CKEditor - Access bypass
by security-news＠drupal.org 09 Nov '11

09 Nov '11

* Advisory ID: DRUPAL-SA-CONTRIB-2011-054 * Project: CKEditor - WYSIWYG HTML editor [1] (third-party module) * Version: 7.x * Date: 2011-November-09 * Security risk: Critical [2] * Exploitable from: Remote * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- The CKEditor module allows Drupal to replace textarea fields with the CKEditor - a visual HTML editor, sometimes called WYSIWYG editor. The module doesn't protect private files appropriately. Private files can downloaded by anyone able to guess their URL. -------- VERSIONS AFFECTED --------------------------------------------------- * CKEditor 7.x-1.4 version only Drupal core is not affected. If you do not use the contributed CKEditor - WYSIWYG HTML editor [3] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * Upgrade to CKEditor 7.x-1.5 [4] See also the CKEditor - WYSIWYG HTML editor [5] project page. -------- REPORTED BY --------------------------------------------------------- * Joel Walters [6] -------- FIXED BY ------------------------------------------------------------ * Michal [7] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Stéphane Corlosquet [8] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at http://drupal.org/contact [9]. Learn more about the Drupal Security team and their policies [10], writing secure code for Drupal [11], and securing your site [12]. [1] http://drupal.org/project/ckeditor [2] http://drupal.org/security-team/risk-levels [3] http://drupal.org/project/ckeditor [4] http://drupal.org/node/1336272 [5] http://drupal.org/project/ckeditor [6] http://drupal.org/user/1052318 [7] http://drupal.org/user/922884 [8] http://drupal.org/user/52142 [9] http://drupal.org/contact [10] http://drupal.org/security-team [11] http://drupal.org/writing-secure-code [12] http://drupal.org/security/secure-configuration

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news