- Security-news - lists.drupal.org

Bookable Calendar - Less critical - Access bypass - SA-CONTRIB-2025-070
by security-news＠drupal.org 28 May '25

28 May '25

View online: https://www.drupal.org/sa-contrib-2025-070 Project: Bookable Calendar [1] Date: 2025-May-28 Security risk: *Less critical* 9 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <2.2.13 CVE IDs: CVE-2025-48916 Description: This module enables you to setup a repeating date rule that users can "book" different dates, allowing you to let users register for a variety of different things like conference rooms or guitar lessons. This module has a permission of "view booking" and "view booking contact" which allows you to view them regardless of whether you own them or not. Due to bad naming of the permissions it's likely admins have configured those to users that shouldn't have them. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "view booking" or "view booking contact". Solution: Install the latest version: * If you use the Bookable Calendar module for Drupal 8.x, upgrade to Bookable Calendar 2.2.13 [3] .. Manual Steps to patch issue This fix requires a View update to resolve the issue. The full view config can be found in: config/install/views.view.booking_contant.yml. If you haven't customised this view yourself, you can just re-import the view config, either through the Config Sync UI or through drush like this: drush cim --partial --source=modules/contrib/bookable_calendar/config/install. The Drush config import will import all View changes to the whole module, not just this one view. If you want to manually update the view through the Views UI, go to admin/structure/views/view/booking_contact and edit both the User Bookings and Past Bookings display on the view. The only change required is in the Contextual Filter, add a Validation Criteria under the section (when the filter is in the URL or a default is provided) and set the Action to "Display 'Access Denied'". Reported By: * Ludo Hartzema (absoludo) [4] Fixed By: * Ludo Hartzema (absoludo) [5] * Josh Fabean (josh.fabean) [6] Coordinated By: * Bram Driesen (bramdriesen) [7] * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team * Cathy Theys (yesct) [10] of the Drupal Security Team [1] https://www.drupal.org/project/bookable_calendar [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/bookable_calendar/releases/2.2.13 [4] https://www.drupal.org/u/absoludo [5] https://www.drupal.org/u/absoludo [6] https://www.drupal.org/u/joshfabean [7] https://www.drupal.org/u/bramdriesen [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://www.drupal.org/u/yesct

1 0

Lightgallery - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-069
by security-news＠drupal.org 21 May '25

21 May '25

View online: https://www.drupal.org/sa-contrib-2025-069 Project: Lightgallery [1] Date: 2025-May-21 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Scripting Affected versions: <1.6.0 CVE IDs: CVE-2025-48447 Description: This module integrates Drupal with LightGallery, enabling the use of the LightGallery library with any image field or view. The module does not adequately sanitize user input in the image field’s "alt" attribute, potentially allowing cross-site scripting (XSS) attacks when tags or scripts are inserted. This vulnerability is partially mitigated by the requirement that an attacker must have permission to create content containing an image field configured to use the LightGallery format. Solution: Install the latest version: * If you use the Lightgallery module, upgrade to Lightgallery 8.x-1.6 [3] Reported By: * Pierre Rudloff (prudloff) [4] Fixed By: * Murilo Henrique Pucci (murilohp) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team * Pierre Rudloff (prudloff) [8] [1] https://www.drupal.org/project/lightgallery [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/lightgallery/releases/8.x-1.6 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/murilohp [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/poker10 [8] https://www.drupal.org/u/prudloff

1 0

Admin Audit Trail - Less critical - Denial of Service - SA-CONTRIB-2025-068
by security-news＠drupal.org 21 May '25

21 May '25

View online: https://www.drupal.org/sa-contrib-2025-068 Project: Admin Audit Trail [1] Date: 2025-May-21 Security risk: *Less critical* 9 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:Default [2] Vulnerability: Denial of Service Affected versions: <1.0.5 CVE IDs: CVE-2025-48448 Description: The Admin Audit Trail module tracks logs of specific events that you'd like to review. When the submodule Admin Audit Trail: User Authentication is enabled, it logs user authentication events (login, logout, and password reset requests). The module does not sufficiently limit some large values before logging the data. Solution: Install the latest version: * If you use the Admin Audit Trail module for Drupal 9/10/11, upgrade to Admin Audit Trail 1.0.5 [3] Reported By: * Scott Phillips (scottatdrake) [4] Fixed By: * Rajab Natshah (rajab natshah) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Juraj Nemec (poker10) [7] of the Drupal Security Team [1] https://www.drupal.org/project/admin_audit_trail [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/admin_audit_trail/releases/1.0.5 [4] https://www.drupal.org/u/scottatdrake [5] https://www.drupal.org/u/rajab-natshah [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/poker10

1 0

Commerce Alphabank Redirect - Moderately critical - Access bypass - SA-CONTRIB-2025-067
by security-news＠drupal.org 21 May '25

21 May '25

View online: https://www.drupal.org/sa-contrib-2025-067 Project: Commerce Alphabank Redirect [1] Date: 2025-May-21 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <1.0.3 CVE IDs: CVE-2025-48446 Description: This module enables you to pay for Commerce order to an environment provided and secured by the bank The module doesn't sufficiently verify the payment status on canceled orders. An attacker can issue a specially crafted request to update the order status to completed. Solution: Install the latest version: * If you use the commerce_alphabank_redirect module for Drupal 8.x, upgrade to commerce_alphabank_redirect 1.0.3 [3] Reported By: * Marios Tsalkidis (silios) [4] Fixed By: * Bill Seremetis (bserem) [5] * Panagiotis Moutsopoulos (vensires) [6] Coordinated By: * Greg Knaddison (greggles) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team [1] https://www.drupal.org/project/commerce_alphabank_redirect [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/commerce_alphabank_redirect/releases/1.0.3 [4] https://www.drupal.org/u/silios [5] https://www.drupal.org/u/bserem [6] https://www.drupal.org/u/vensires [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/poker10

1 0

Commerce Eurobank (Redirect) - Moderately critical - Access bypass - SA-CONTRIB-2025-066
by security-news＠drupal.org 21 May '25

21 May '25

View online: https://www.drupal.org/sa-contrib-2025-066 Project: Commerce Eurobank (Redirect) [1] Date: 2025-May-21 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <2.1.1 CVE IDs: CVE-2025-48445 Description: This module enables you to pay for Commerce order to an environment provided and secured by the bank The module doesn't sufficiently verify the payment status on canceled orders. An attacker can issue a specially crafted request to update the order status to completed. Solution: Install the latest version: * If you use the commerce_eurobank_redirect module for Drupal 8.x, upgrade to commerce_eurobank_redirect 2.1.1 [3] Reported By: * Marios Tsalkidis (silios) [4] Fixed By: * Bill Seremetis (bserem) [5] * Panagiotis Moutsopoulos (vensires) [6] Coordinated By: * Greg Knaddison (greggles) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team [1] https://www.drupal.org/project/commerce_eurobank_redirect [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/commerce_eurobank_redirect/releases/2.1.1 [4] https://www.drupal.org/u/silios [5] https://www.drupal.org/u/bserem [6] https://www.drupal.org/u/vensires [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/poker10

1 0

Quick Node Block - Moderately critical - Access bypass - SA-CONTRIB-2025-065
by security-news＠drupal.org 21 May '25

21 May '25

View online: https://www.drupal.org/sa-contrib-2025-065 Project: Quick Node Block [1] Date: 2025-May-21 Security risk: *Moderately critical* 13 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <2.0.0 CVE IDs: CVE-2025-48013 Description: This module provides a block to easily display a rendered node. Access to the rendered node isn't validated before rendering the block. Allowing access to node content for users that would normally not be allowed to access the node. Solution: Update to the latest version. * If you use the Quick Node Block module, update to Quick Node Block 2.0.1 [3] Reported By: * Mitch Portier (arkener) [4] Fixed By: * Mitch Portier (arkener) [5] * Antonio Sánchez (saesa) [6] Coordinated By: * Greg Knaddison (greggles) [7] of the Drupal Security Team * Ivo Van Geertruyen (mr.baileys) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team [1] https://www.drupal.org/project/quick_node_block [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/quick_node_block/releases/2.0.1 [4] https://www.drupal.org/u/arkener [5] https://www.drupal.org/u/arkener [6] https://www.drupal.org/u/saesa [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/mrbaileys [9] https://www.drupal.org/u/poker10

1 0

Quick Node Block - Moderately critical - Access bypass - SA-CONTRIB-2025-064
by security-news＠drupal.org 21 May '25

21 May '25

View online: https://www.drupal.org/sa-contrib-2025-064 Project: Quick Node Block [1] Date: 2025-May-21 Security risk: *Moderately critical* 11 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <2.0.0 CVE IDs: CVE-2025-48444 Description: This module provides a block to easily display a rendered node. The module doesn't check access to content before displaying it to a visitor, allowing unauthorized users to retrieve a list of labels of all nodes. Solution: Update to the latest version. * If you use the Quick Node Block module, update to Quick Node Block 2.0.1 [3] Reported By: * Mitch Portier (arkener) [4] Fixed By: * Mitch Portier (arkener) [5] * Antonio Sánchez (saesa) [6] Coordinated By: * Greg Knaddison (greggles) [7] of the Drupal Security Team * Ivo Van Geertruyen (mr.baileys) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team [1] https://www.drupal.org/project/quick_node_block [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/quick_node_block/releases/2.0.1 [4] https://www.drupal.org/u/arkener [5] https://www.drupal.org/u/arkener [6] https://www.drupal.org/u/saesa [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/mrbaileys [9] https://www.drupal.org/u/poker10

1 0

One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-063
by security-news＠drupal.org 14 May '25

14 May '25

View online: https://www.drupal.org/sa-contrib-2025-063 Project: One Time Password [1] Date: 2025-May-14 Security risk: *Moderately critical* 14 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <1.3.0 CVE IDs: CVE-2025-48012 Description: This module enables you to allow users to include a second authentication method in addition to password authentication. The module doesn't sufficiently prevent the same TFA token within a 30 second window. This vulnerability is mitigated by the fact that an attacker must obtain a valid username/password and second factor. Solution: Install the latest version: * If you use the One Time Password module for Drupal, upgrade to One Time Password 8.x-1.3 [3] Reported By: * Conrad Lara (cmlara) [4] Fixed By: * danielveza [5] * Lee Rowlands (larowlan) [6] of the Drupal Security Team * Ivo Van Geertruyen (mr.baileys) [7] of the Drupal Security Team Coordinated By: * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team [1] https://www.drupal.org/project/one_time_password [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/one_time_password/releases/8.x-1.3 [4] https://www.drupal.org/u/cmlara [5] https://www.drupal.org/u/danielveza [6] https://www.drupal.org/u/larowlan [7] https://www.drupal.org/u/mrbaileys [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10

1 0

One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-062
by security-news＠drupal.org 14 May '25

14 May '25

View online: https://www.drupal.org/sa-contrib-2025-062 Project: One Time Password [1] Date: 2025-May-14 Security risk: *Moderately critical* 14 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <1.3.0 CVE IDs: CVE-2025-48011 Description: This module enables you to allow users to include a second authentication method in addition to password authentication. The module doesn't sufficiently prevent TFA from being bypassed when using the REST login routes. A new requirements check has been added to the status report so other authentication providers can be assessed to check if they also allow for this bypass. This vulnerability is mitigated by the fact that an attacker must obtain a valid username/password. Solution: Install the latest version: * If you use the One Time Password module for Drupal, upgrade to One Time Password 8.x-1.3 [3] Reported By: * Conrad Lara (cmlara) [4] Fixed By: * danielveza [5] * Kim Pepper (kim.pepper) [6] * Lee Rowlands (larowlan) [7] of the Drupal Security Team Coordinated By: * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team [1] https://www.drupal.org/project/one_time_password [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/one_time_password/releases/8.x-1.3 [4] https://www.drupal.org/u/cmlara [5] https://www.drupal.org/u/danielveza [6] https://www.drupal.org/u/kimpepper [7] https://www.drupal.org/u/larowlan [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10

1 0

One Time Password - Moderately critical - Access bypass - SA-CONTRIB-2025-061
by security-news＠drupal.org 14 May '25

14 May '25

View online: https://www.drupal.org/sa-contrib-2025-061 Project: One Time Password [1] Date: 2025-May-14 Security risk: *Moderately critical* 14 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <1.3.0 CVE IDs: CVE-2025-48010 Description: This module enables you to allow users to include a second authentication method in addition to password authentication. The module doesn't sufficiently prevent one time login links from bypassing TFA. This vulnerability is mitigated by the fact that an attacker must have access to an email account attached to a user or a valid one time password link for a user. Solution: Install the latest version: * If you use the One Time Password module for Drupal, upgrade to One Time Password 8.x-1.3 [3] Reported By: * Conrad Lara (cmlara) [4] Fixed By: * danielveza [5] * Kim Pepper (kim.pepper) [6] * Lee Rowlands (larowlan) [7] of the Drupal Security Team Coordinated By: * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team [1] https://www.drupal.org/project/one_time_password [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/one_time_password/releases/8.x-1.3 [4] https://www.drupal.org/u/cmlara [5] https://www.drupal.org/u/danielveza [6] https://www.drupal.org/u/kimpepper [7] https://www.drupal.org/u/larowlan [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10

1 0