- Security-news - lists.drupal.org

Block Attributes - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-090
by security-news＠drupal.org 16 Jul '25

16 Jul '25

View online: https://www.drupal.org/sa-contrib-2025-090 Project: Block Attributes [1] Date: 2025-July-16 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site Scripting Affected versions: <1.1.0 || >=2.0.0 <2.0.1 CVE IDs: CVE-2025-7715 Description: This module allows you to define custom attributes for a block. You can specify an attribute name to be added to the block in a predefined format. The module does not sufficiently validate the provided attributes, which makes it possible to insert JavaScript event attributes such as onmouseover, onkeyup, etc. These attributes can execute JavaScript code when the page is rendered, leading to cross-site scripting (XSS) vulnerabilities. This vulnerability is partially mitigated by the requirement to manually add the specific attributes and corresponding JavaScript code to the form after the attribute has been created. Solution: Install the latest version: * If you use the Block Attributes module for Drupal, upgrade to Block Attributes 8.x-1.1 [3] or Block Attributes 2.0.1 [4]. Reported By: * Pierre Rudloff (prudloff) [5] provisional member of the Drupal Security Team Fixed By: * Kostia Bohach (_shy) [6] Coordinated By: * Greg Knaddison (greggles) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team * Pierre Rudloff (prudloff), provisional member of the Drupal Security Team [9] * Jess (xjm) [10] of the Drupal Security Team [1] https://www.drupal.org/project/block_attributes [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/block_attributes/releases/8.x-1.1 [4] https://www.drupal.org/project/block_attributes/releases/2.0.1 [5] https://www.drupal.org/u/prudloff [6] https://www.drupal.org/u/_shy [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/poker10 [9] https://www.drupal.org/u/prudloff [10] https://www.drupal.org/u/xjm

1 0

File Download - Moderately critical - Access bypass - SA-CONTRIB-2025-089
by security-news＠drupal.org 16 Jul '25

16 Jul '25

View online: https://www.drupal.org/sa-contrib-2025-089 Project: File Download [1] Date: 2025-July-16 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <1.9.0 || >=2.0.0 <2.0.1 CVE IDs: CVE-2025-7717 Description: The File Download enables you to allow users to download file and image entities directly using a custom field formatter. It also provides an optional submodule to count and display file downloads in Views, similar to how the core statistics module tracks content views. The File Download module does not properly validate input when handling file access requests. This can allow users to bypass protections and access private files that should not be publicly available. Solution: Install the latest version: * If you use the File Download module for Drupal 8.x, upgrade to File Download 2.0.1 [3] or File Download 8.x-1.9 [4]. Reported By: * Willem Drupal enthousiast (willempje2) [5] Fixed By: * Shelane French (shelane) [6] * Willem Drupal enthousiast (willempje2) [7] Coordinated By: * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team * Jess (xjm) [10] of the Drupal Security Team [1] https://www.drupal.org/project/file_download [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/file_download/releases/2.0.1 [4] https://www.drupal.org/project/file_download/releases/8.x-1.9 [5] https://www.drupal.org/u/willempje2 [6] https://www.drupal.org/u/shelane [7] https://www.drupal.org/u/willempje2 [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://www.drupal.org/u/xjm

1 0

Mail Login - Critical - Access bypass - SA-CONTRIB-2025-088
by security-news＠drupal.org 09 Jul '25

09 Jul '25

View online: https://www.drupal.org/sa-contrib-2025-088 Project: Mail Login [1] Date: 2025-July-09 Security risk: *Critical* 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: >3.0.0 <3.2.0 || >=4.0.0 <4.2.0 CVE IDs: CVE-2025-7393 Description: This module enables users to login by email address with the minimal configurations. The module included some protection against brute force attacks on the login form, however they were incomplete. An attacker could bypass the brute force protection allowing them to potentially gain access to an account. Solution: Install the latest version: * If you use the mail_login 3.x, upgrade to Mail Login 3.2.0 [3] * If you use the mail_login 4.x, upgrade to Mail Login 4.2.0 [4] Reported By: * Ryugo Kinoshita (dc-kinoshita) [5] Fixed By: * Damien McKenna (damienmckenna) [6] of the Drupal Security Team * Mohammad AlQanneh (mqanneh) [7] Coordinated By: * Greg Knaddison (greggles) [8] of the Drupal Security Team [1] https://www.drupal.org/project/mail_login [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/mail_login/releases/3.2.0 [4] https://www.drupal.org/project/mail_login/releases/4.2.0 [5] https://www.drupal.org/u/dc-kinoshita [6] https://www.drupal.org/u/damienmckenna [7] https://www.drupal.org/u/mqanneh [8] https://www.drupal.org/u/greggles

1 0

Cookies Addons - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-087
by security-news＠drupal.org 09 Jul '25

09 Jul '25

View online: https://www.drupal.org/sa-contrib-2025-087 Project: Cookies Addons [1] Date: 2025-July-09 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross-site Scripting Affected versions: >1.0.0 < 1.2.4 CVE IDs: CVE-2025-7392 Description: This module provides a format filter, which allows you to "disable" iframes (e.g. remove their src attribute) specified by the user. These elements will be enabled again, once the Cookies banner is accepted. The module doesn't sufficiently filter user-supplied content when their value might contain malicious content leading to a Cross-site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that the site must have the Cookies Addons Embed Iframe submodule enabled and an attacker must have the correct permissions to use a text field with a text format that allows iframes to be used. Solution: Install the latest version: * Upgrade to Cookies Addons 1.2.4 [3] Reported By: * Pierre Rudloff (prudloff) [4] provisional member of the Drupal Security Team Fixed By: * Guido Schmitz (guido_s) [5] * Kostia Bohach (_shy) [6] Coordinated By: * Greg Knaddison (greggles) [7] of the Drupal Security Team * Pierre Rudloff (prudloff) [8] provisional member of the Drupal Security Team [1] https://www.drupal.org/project/cookies_addons [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/cookies_addons/releases/1.2.4 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/guido_s [6] https://www.drupal.org/u/_shy [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/prudloff

1 0

Config Pages Viewer - Critical - Access bypass - SA-CONTRIB-2025-086
by security-news＠drupal.org 02 Jul '25

02 Jul '25

View online: https://www.drupal.org/sa-contrib-2025-086 Project: Config Pages Viewer [1] Date: 2025-July-02 Security risk: *Critical* 15 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <1.0.4 CVE IDs: CVE-2025-7031 Description: This module enables you to use config_pages [3] as a content entity. The module doesn't check permission or entity access before rendering config_pages content. Solution: Install the latest version: * If you use the Config Pages Viewer module at version 1.0.3 and lesser, upgrade to Config Pages Viewer 1.0.4 [4]. Reported By: * Pierre Rudloff (prudloff) [5] Fixed By: * drdam [6] * Pierre Rudloff (prudloff) [7] Coordinated By: * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team * Jess (xjm) [10] of the Drupal Security Team [1] https://www.drupal.org/project/config_pages_viewer [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/config_pages [4] https://www.drupal.org/node/3533571 [5] https://www.drupal.org/u/prudloff [6] https://www.drupal.org/u/drdam [7] https://www.drupal.org/u/prudloff [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://www.drupal.org/u/xjm

1 0

Two-factor Authentication (TFA) - Less critical - Access bypass - SA-CONTRIB-2025-085
by security-news＠drupal.org 02 Jul '25

02 Jul '25

View online: https://www.drupal.org/sa-contrib-2025-085 Project: Two-factor Authentication (TFA) [1] Date: 2025-July-02 Security risk: *Less critical* 9 ∕ 25 AC:Basic/A:Admin/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <1.11.0 CVE IDs: CVE-2025-7030 Description: This module enables you to allow and/or require a second authentication method in addition to password authentication. The module does not sufficiently ensure that users with enhanced privileges are prevented from viewing recovery codes of other users. This vulnerability is mitigated by the fact that an attacker must have a role with the /Administer TFA for other users/ permission. Solution: Install the latest version: * If you use the Two-factor Authentication (TFA) module for Drupal 8.x, upgrade to Two-factor Authentication (TFA) 8.x-1.11 [3]. Reported By: * Conrad Lara (cmlara) [4] Fixed By: * Conrad Lara (cmlara) [5] Coordinated By: * cilefen (cilefen) [6] of the Drupal Security Team * Dan Smith (galooph) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Jess (xjm) [9] of the Drupal Security Team [1] https://www.drupal.org/project/tfa [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/tfa/releases/8.x-1.11 [4] https://www.drupal.org/u/cmlara [5] https://www.drupal.org/u/cmlara [6] https://www.drupal.org/u/cilefen [7] https://www.drupal.org/u/galooph [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/xjm

1 0

Paragraphs table - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-084
by security-news＠drupal.org 25 Jun '25

25 Jun '25

View online: https://www.drupal.org/sa-contrib-2025-084 Project: Paragraphs table [1] Date: 2025-June-25 Security risk: *Moderately critical* 13 ∕ 25 AC:None/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross Site Scripting Affected versions: >=2.0.0 <2.0.5 CVE IDs: CVE-2025-6677 Description: Project Paragraphs table provides a field for a collection table. The module doesn't sufficiently sanitise certain data attributes allowing Cross Site Scripting (XSS) attacks. This vulnerability is mitigated by the fact that an attacker must have a role with permission to enter HTML tags containing specific data attributes. Solution: Install the latest version: * If you use the Paragraphs table module 2.x for Drupal 10 or above, please upgrade to paragraphs table 2.0.5 [3] Reported By: * Pierre Rudloff (prudloff) [4] Fixed By: * Joseph Olstad (joseph.olstad) [5] * NGUYEN Bao (lazzyvn) [6] Coordinated By: * Greg Knaddison (greggles) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team [1] https://www.drupal.org/project/paragraphs_table [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/paragraphs_table/releases/2.0.5 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/josepholstad [6] https://www.drupal.org/u/lazzyvn [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/poker10

1 0

Simple XML sitemap - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-083
by security-news＠drupal.org 25 Jun '25

25 Jun '25

View online: https://www.drupal.org/sa-contrib-2025-083 Project: Simple XML sitemap [1] Date: 2025-June-25 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site Scripting Affected versions: < 4.2.2 CVE IDs: CVE-2025-6676 Description: Simple XML sitemap [3] is a SEO module that allows creating various XML sitemaps of the site's content and submitting them to search engines. The module doesn't sufficiently sanitize input when administering it, which leads to a Cross-site scripting (XSS) attack vector. This vulnerability is mitigated by the fact that an attacker must have the administrative permission 'administer sitemap settings'. Solution: This vulnerability requires 2 steps: * If you use simple_sitemap upgrade to at least 4.2.2 [4] or a later, supported version. * For all versions, ensure your permissions are assigned to appropriate roles and users with "administer sitemap settings" permission are trusted. Reported By: * Nick Vanpraet (grayle) [5] Fixed By: * David Rothstein (David_Rothstein) [6] * Pawel Ginalski (gbyte) [7] Coordinated By: * Greg Knaddison (greggles) [8] of the Drupal Security Team * Michael Hess (mlhess) [9] of the Drupal Security Team * Juraj Nemec (poker10) [10] of the Drupal Security Team [1] https://www.drupal.org/project/simple_sitemap [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/simple_sitemap [4] https://www.drupal.org/project/simple_sitemap/releases/4.2.2 [5] https://www.drupal.org/u/grayle [6] https://www.drupal.org/u/david_rothstein [7] https://www.drupal.org/u/gbyte [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/mlhess [10] https://www.drupal.org/u/poker10

1 0

Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-082
by security-news＠drupal.org 25 Jun '25

25 Jun '25

View online: https://www.drupal.org/sa-contrib-2025-082 Project: Enterprise MFA - TFA for Drupal [1] Date: 2025-June-25 Security risk: *Critical* 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <4.8.0 || >=5.2.0 <5.2.1 || 5.0.* || 5.1.* CVE IDs: CVE-2025-6675 Description: The module enables you to add second-factor authentication on top of the default Drupal login. The module does not sufficiently ensure that known authorization routes are protected. This vulnerability is mitigated by the fact that an attacker must obtain the user's username and password. Solution: Install the latest version: * If you use the Enterprise MFA - TFA for Drupal ^9.3, Drupal 10 and Drupal 11 upgrade to miniorange_2fa 5.2.1. [3] * If you use the Enterprise MFA - TFA for Drupal 8, Drupal 9 and Drupal 10 upgrade to miniorange_2fa 8.x-4.8. [4] Reported By: * Conrad Lara (cmlara) [5] Fixed By: * Sudhanshu Dhage (sudhanshu0542) [6] Coordinated By: * Greg Knaddison (greggles) [7] of the Drupal Security Team [1] https://www.drupal.org/project/miniorange_2fa [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/miniorange_2fa/releases/5.2.1 [4] https://www.drupal.org/project/miniorange_2fa/releases/8.x-4.8 [5] https://www.drupal.org/u/cmlara [6] https://www.drupal.org/u/sudhanshu0542 [7] https://www.drupal.org/u/greggles

1 0

CKEditor5 Youtube - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-081
by security-news＠drupal.org 25 Jun '25

25 Jun '25

View online: https://www.drupal.org/sa-contrib-2025-081 Project: CKEditor5 Youtube [1] Date: 2025-June-25 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site Scripting Affected versions: <1.0.3 CVE IDs: CVE-2025-6674 Description: The CKEditor5 Youtube module enhances content creation in Drupal by seamlessly integrating YouTube video embedding into the CKEditor 5 text editor. The module doesn't sufficiently validate iframe sources under the scenario where a user embeds a video using the CKEditor YouTube integration leading to a Cross-site Scripting (XSS) vulnerabiity. This vulnerability is mitigated by the fact that an attacker must have a role with necessary permissions to use CKEditor Youtube embed button. Solution: Install the latest version: * If you are using the CKEditor5 YouTube module on Drupal 9.x or higher, you should upgrade to: CKEditor5 Youtube 1.0.3 [3] Reported By: * nico.b [4] Fixed By: * Brahim Khouy (b.khouy) [5] * Abderrahim GHAZALI 🤘 (g.abderrahim) [6] * nico.b [7] Coordinated By: * Greg Knaddison (greggles) [8] of the Drupal Security Team [1] https://www.drupal.org/project/ckeditor5_youtube [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ckeditor5_youtube/releases/1.0.3 [4] https://www.drupal.org/u/nicob [5] https://www.drupal.org/u/bkhouy [6] https://www.drupal.org/u/gabderrahim [7] https://www.drupal.org/u/nicob [8] https://www.drupal.org/u/greggles

1 0