Security-news

security-news@drupal.org

1 participants
1782 discussions

Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-001
by security-news＠drupal.org 08 Jan '25

08 Jan '25

View online: https://www.drupal.org/sa-contrib-2025-001 Project: Email TFA [1] Date: 2025-January-08 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <2.0.3 Description: This module enables you to do Two-Factor Authentication by email, using a user registered email to send a verification code to the user's email every time the user tries to log in to your site. The module did not sufficiently protect against brute force attacks, allowing an attacker to bypass the second factor. This vulnerability is mitigated by the fact the attacker must be able to present the username and first factor (i.e. password). Solution: Install the latest version: * If you use the Email TFA module, upgrade to Email TFA 2.0.3 [3] Reported By: * Ursin Cola [4] Fixed By: * Ursin Cola [5] * abdulaziz zaid [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team * Juraj Nemec [8] of the Drupal Security Team [1] https://www.drupal.org/project/email_tfa [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/email_tfa/releases/2.0.3 [4] https://www.drupal.org/user/679260 [5] https://www.drupal.org/user/679260 [6] https://www.drupal.org/user/3585656 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/272316

1 0

Drupal 7 End of Life - PSA-2025-01-06
by security-news＠drupal.org 08 Jan '25

08 Jan '25

View online: https://www.drupal.org/psa-2025-01-06 Date: 2025-January-06 Description: Drupal core version 7 has reached end of life, and is no longer community supported on Drupal.org. This means that new releases of Drupal 7 core and contributed projects will no longer happen on Drupal.org and community support is no longer provided. *What this means for you:* 1) Any vulnerabilities that impact Drupal 7 may be released and made public without Security Advisories or warnings. Please continue to follow the process outlined in: Report a security issue [1] 2) Drupal 7 will no longer be supported. There will be no more core commits on Drupal 7.x to the official repository. The community will no longer be creating new Drupal 7 releases, fixing bugs in existing projects, writing documentation, etc. around Drupal 7. 3) The Drupal Security Team will no longer provide support or Security Advisories for Drupal 7 and Drupal-7-compatible contributed projects. 4) All Drupal 7 releases on project pages will be flagged as not supported. At some point in the future, update status and packages.drupal.org/7 will stop working for Drupal 7 sites. *Solution:* You can learn about upgrading Drupal and migrations [2] or read about other options [3]. [1] https://www.drupal.org/docs/develop/issues/issue-procedures-and-etiquette/r… [2] https://www.drupal.org/about/drupal-7/d7eol/diy [3] https://www.drupal.org/about/drupal-7/d7eol

1 0

Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-076
by security-news＠drupal.org 11 Dec '24

11 Dec '24

View online: https://www.drupal.org/sa-contrib-2024-076 Project: Open Social [1] Date: 2024-December-11 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <12.3.10 || >=12.4.0 <12.4.9 Description: Open Social is a Drupal distribution for online communities, which ships with a default (optional) module social_file_private to ensure the images and files provided by the distribution are stored in the private instead of the public filesystem. During updates from Open Social versions installed prior to 11.8.0 these files were not updated correctly and as a result the module didn't allow access checks to run correctly. Solution: Install the latest version and make sure to run the update hooks. * If you use Open Social 12.3.x upgrade to Open Social 12.3.10 [3] * If you use Open Social 12.4.x upgrade to Open Social 12.4.9 [4] Reported By: * corn696 [5] Fixed By: * corn696 [6] * Robert Ragas [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/social [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/social/releases/12.3.10 [4] https://www.drupal.org/project/social/releases/12.4.9 [5] https://www.drupal.org/user/3544002 [6] https://www.drupal.org/user/3544002 [7] https://www.drupal.org/user/2723261 [8] https://www.drupal.org/user/36762

1 0

Allow All File Extensions for file fields - Critical - Unsupported - SA-CONTRIB-2024-075
by security-news＠drupal.org 11 Dec '24

11 Dec '24

View online: https://www.drupal.org/sa-contrib-2024-075 Project: Allow All File Extensions for file fields [1] Date: 2024-December-11 Security risk: *Critical* 18 ∕ 25 AC:Basic/A:User/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [4] [1] https://www.drupal.org/project/all_extensions [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [4] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta…

1 0

Git Utilities for Drupal - Critical - Unsupported - SA-CONTRIB-2024-074
by security-news＠drupal.org 11 Dec '24

11 Dec '24

View online: https://www.drupal.org/sa-contrib-2024-074 Project: Git Utilities for Drupal [1] Date: 2024-December-11 Security risk: *Critical* 17 ∕ 25 AC:Basic/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [4] [1] https://www.drupal.org/project/git_utils [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [4] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta…

1 0

11 Dec '24

View online: https://www.drupal.org/sa-contrib-2024-073 Project: Login Disable [1] Date: 2024-December-11 Security risk: *Critical* 16 ∕ 25 AC:None/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: >=2.0.0 <2.1.1 Description: This module enables you to prevent existing users from logging in to your Drupal site unless they know the secret key to add to the end of the ?q=user login form page. The Login Disable module does not correctly prevent a user with a disabled login from logging in, allowing those users to by-pass the protection offered by the module. This vulnerability is mitigated by the fact that an attacker must already have a user account to log in. This bug therefore allows users to log in even if their login is disabled. Solution: Install the latest version: * If you use the Login Disable module for Drupal 9.x / 10.x, upgrade to Login Disable 2.1.1 [3] The Drupal 7 version of the module is not affected. Reported By: * e5sego [4] Fixed By: * e5sego [5] * Sang Lostrie [6] Coordinated By: * Ivo Van Geertruyen [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team * Benji Fisher [9] of the Drupal Security Team [1] https://www.drupal.org/project/login_disable [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/login_disable/releases/2.1.1 [4] https://www.drupal.org/user/261590 [5] https://www.drupal.org/user/261590 [6] https://www.drupal.org/user/2727459 [7] https://www.drupal.org/u/mrbaileys [8] https://security.drupal.org/user/27 [9] https://www.drupal.org/u/benjifisher

1 0

Browser Back Button - Moderately critical - Cross site scripting - SA-CONTRIB-2024-072
by security-news＠drupal.org 11 Dec '24

11 Dec '24

View online: https://www.drupal.org/sa-contrib-2024-072 Project: Browser Back Button [1] Date: 2024-December-11 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Affected versions: >=1.0.0 <2.0.2 Description: This module provides a block that renders a link providing the functionality of a browser's back button. The module does not sufficiently escape text entered by an administrator, resulting in a cross scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer blocks". Solution: Install the latest version: * If you use the Browser Back Button module for Drupal 9.x/10.x, upgrade to Browser Back Button 2.0.2 [3] Reported By: * Patrick Fey [4] Fixed By: * Elavarasan R [5] Coordinated By: * Ivo Van Geertruyen [6] of the Drupal Security Team [1] https://www.drupal.org/project/browser_back_button [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/browser_back_button/releases/2.0.2 [4] https://www.drupal.org/user/998680 [5] https://www.drupal.org/user/1902634 [6] https://www.drupal.org/u/mrbaileys

1 0

Entity Form Steps - Moderately critical - Cross site scripting - SA-CONTRIB-2024-071
by security-news＠drupal.org 04 Dec '24

04 Dec '24

View online: https://www.drupal.org/sa-contrib-2024-071 Project: Entity Form Steps [1] Date: 2024-December-04 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Affected versions: <1.1.4 Description: This module allows a site builder to create multi-step entity forms leveraging the Field Group field type plugins. The module doesn't escape plain text administrative configurations. An attacker with admin access could inject arbitrary JavaScript code. This vulnerability is mitigated by the fact that an attacker must have a role with the 'administer [entity_type] form display' permission allowing access to configure entity form displays. Solution: Install the latest version: * If you use the Entity Form Steps module for Drupal 9.x/10.x, upgrade to Entity Form Steps 1.1.4 [3] Reported By: * Ide Braakman [4] Fixed By: * Rob [5] Coordinated By: * Ivo Van Geertruyen [6] of the Drupal Security Team [1] https://www.drupal.org/project/entity_form_steps [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/entity_form_steps/releases/1.1.4 [4] https://www.drupal.org/user/1879760 [5] https://www.drupal.org/user/459772 [6] https://www.drupal.org/u/mrbaileys

1 0

Minify JS - Moderately critical - Cross site request forgery - SA-CONTRIB-2024-070
by security-news＠drupal.org 04 Dec '24

04 Dec '24

View online: https://www.drupal.org/sa-contrib-2024-070 Project: Minify JS [1] Date: 2024-December-04 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site request forgery Affected versions: <3.0.3 Description: The Minify JS module allows a site administrator to minify all javascript files that exist in the site's code base and use those minified files on the front end of the website. Several administrator routes are unprotected against Cross-Site Request Forgery (CRSF) attacks. Solution: Install the latest version: * If you use the Minify JS module for Drupal 7.x, upgrade to Minify JS 7.x-1.11 [3] * If you use the Minify JS module for Drupal 8.x, upgrade to Minify JS 3.0.3 [4] Reported By: * Pierre Rudloff [5] Fixed By: * Ivo Van Geertruyen [6] of the Drupal Security Team * Scott Joudry [7] Coordinated By: * Ivo Van Geertruyen [8] of the Drupal Security Team [1] https://www.drupal.org/project/minifyjs [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/minifyjs/releases/7.x-1.11 [4] https://www.drupal.org/project/minifyjs/releases/3.0.3 [5] https://www.drupal.org/user/3611858 [6] https://www.drupal.org/user/383424 [7] https://www.drupal.org/user/1846786 [8] https://www.drupal.org/user/383424

1 0

Download All Files - Critical - Access bypass - SA-CONTRIB-2024-069
by security-news＠drupal.org 04 Dec '24

04 Dec '24

View online: https://www.drupal.org/sa-contrib-2024-069 Project: Download All Files [1] Date: 2024-December-04 Security risk: *Critical* 16 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Proof/TD:All [2] Vulnerability: Access bypass Affected versions: <2.0.2 Description: This module provides a field formatter for the field type 'file' called `Table of files with download all link` . The module had vulnerabilities allowing a user to download files they normally should not be able to download. Solution: Install the latest version: * If you use the Download All Files module, upgrade to 2.0.2 version [3] Reported By: * Pierre Rudloff [4] * Jeroen Tubex [5] Fixed By: * Jeroen Tubex [6] * striknin [7] * Giuseppe [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team * Damien McKenna [10] of the Drupal Security Team * Ivo Van Geertruyen [11] of the Drupal Security Team [1] https://www.drupal.org/project/download_all_files [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/download_all_files/releases/2.0.2 [4] https://www.drupal.org/user/3611858 [5] https://www.drupal.org/user/2228934 [6] https://www.drupal.org/user/2228934 [7] https://www.drupal.org/user/1234206 [8] https://www.drupal.org/user/3521392 [9] https://www.drupal.org/user/36762 [10] https://www.drupal.org/user/108450 [11] https://www.drupal.org/user/383424

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news