- Security-news - lists.drupal.org

Single Content Sync - Moderately critical - Access bypass - SA-CONTRIB-2025-060
by security-news＠drupal.org 14 May '25

14 May '25

View online: https://www.drupal.org/sa-contrib-2025-060 Project: Single Content Sync [1] Date: 2025-May-14 Security risk: *Moderately critical* 10 ∕ 25 AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <1.4.12 CVE IDs: CVE-2025-48009 Description: This module enables you to seamlessly migrate and deploy content across environments, eliminating manual steps. It simplifies the process by exporting content to a YML file or a ZIP archive, which can be imported into another environment effortlessly. While the export feature rightfully bypasses implemented access controls, enabling it to extract all entity data, including private and confidential information, to the mentioned formats, it fails to adequately safeguard the generated output. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "export single content" or "Allow user to export all content". Solution: Install the latest version: * If you use the Single Content Sync module for Drupal, upgrade to Single Content Sync 1.4.12. [3] Reported By: * Dezső Biczó (mxr576) [4] Fixed By: * Dave Long (longwave) [5] of the Drupal Security Team * Dezső Biczó (mxr576) [6] * Oleksandr Kuzava (nginex) [7] Coordinated By: * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team [1] https://www.drupal.org/project/single_content_sync [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/single_content_sync/releases/1.4.12 [4] https://www.drupal.org/u/mxr576 [5] https://www.drupal.org/u/longwave [6] https://www.drupal.org/u/mxr576 [7] https://www.drupal.org/u/nginex [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10

1 0

Events Log Track - Moderately critical - Denial of Service - SA-CONTRIB-2025-059
by security-news＠drupal.org 14 May '25

14 May '25

View online: https://www.drupal.org/sa-contrib-2025-059 Project: Events Log Track [1] Date: 2025-May-14 Security risk: *Moderately critical* 10 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:All [2] Vulnerability: Denial of Service Affected versions: <3.1.11 || >=4.0.0 <4.0.2 CVE IDs: CVE-2025-4416 Description: The Events Log Track module enables you to log specific events on a Drupal site. The module doesn't sufficiently mitigate resource consumption for certain requests which allows a Denial of Service attack. Solution: Install the latest version: * If you use the event_log_track_auth_user_login_validate sub-module for Drupal 10.x or 11.x, upgrade to events_log_track 4.0.2 [3] or events_log_track 3.1.11 [4] Reported By: * Scott Phillips (scottatdrake) [5] Fixed By: * Mingsong (mingsong) [6] * Stephen Mustgrave (smustgrave) [7] Coordinated By: * Greg Knaddison (greggles) [8] of the Drupal Security Team [1] https://www.drupal.org/project/events_log_track [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/events_log_track/releases/4.0.2 [4] https://www.drupal.org/project/events_log_track/releases/3.1.11 [5] https://www.drupal.org/u/scottatdrake [6] https://www.drupal.org/u/mingsong [7] https://www.drupal.org/u/smustgrave [8] https://www.drupal.org/u/greggles

1 0

Piwik PRO - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-058
by security-news＠drupal.org 14 May '25

14 May '25

View online: https://www.drupal.org/sa-contrib-2025-058 Project: Piwik PRO [1] Date: 2025-May-14 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Affected versions: <1.3.2 CVE IDs: CVE-2025-4415 Description: This module enables you to add the Piwik Pro web statistics tracking system to your website. The module does not check the JS code that is loaded on the website. So a user with the "Administer Piwik Pro" permission could configure the module to load JS from a malicious website. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer piwik pro" to access the settings form where this can be configured. Solution: Install the latest version: * If you use the Piwik Pro module, upgrade to Piwik Pro 1.3.2 [3] Sites are encouraged to review which roles have that permission and which users have that role, to ensure that only trusted users have that permission. Reported By: * Pierre Rudloff (prudloff) [4] Fixed By: * Hartsak (hartsak) [5] * Josha Hubbers (joshahubbers) [6] Coordinated By: * Juraj Nemec (poker10) [7] of the Drupal Security Team * Pierre Rudloff (prudloff) [8] [1] https://www.drupal.org/project/piwik_pro [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/piwik_pro/releases/1.3.2 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/hartsak [6] https://www.drupal.org/u/joshahubbers-0 [7] https://www.drupal.org/u/poker10 [8] https://www.drupal.org/u/prudloff

1 0

Advanced File Destination - Critical - Multiple vulnerabilities - SA-CONTRIB-2025-057
by security-news＠drupal.org 14 May '25

14 May '25

View online: https://www.drupal.org/sa-contrib-2025-057 Project: Advanced File Destination [1] Date: 2025-May-14 Security risk: *Critical* 15 ∕ 25 Critical 16 ∕ 25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Multiple vulnerabilities Affected versions: * Description: The Advanced File Destination module enhances file upload management in Drupal by allowing users to choose and create custom directories during file uploads. The module has multiple vulnerabilities that were reported through the Drupal Security Team's coordinated vulnerability process. The project maintainer did not follow the terms and conditions for hosting projects on drupal.org that are opted into security coverage, so the module is losing its security coverage. The private issues may be made public at the discretion of the reporter and maintainer. [1] https://www.drupal.org/project/advanced_file_destination [2] https://www.drupal.org/security-team/risk-levels

1 0

Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-056
by security-news＠drupal.org 07 May '25

07 May '25

View online: https://www.drupal.org/sa-contrib-2025-056 Project: Enterprise MFA - TFA for Drupal [1] Date: 2025-May-07 Security risk: *Critical* 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <4.7.0 || >=5.2.0 <5.2.0 || 5.0.* CVE IDs: CVE-2025-47710 Description: The module enables you to add second-factor authentication in addition to the default Drupal login. The module does not sufficiently ensure that known login routes are protected. This vulnerability is mitigated by the fact that an attacker must obtain the user's username and password. Solution: Install the latest version: * If you use the Enterprise MFA - TFA for Drupal Drupal ^9.3, Drupal 10 and Drupal 11 upgrade to miniorange_2fa 5.2.0 [3]. * If you use the Enterprise MFA - TFA for Drupal Drupal 8, Drupal 9 and Drupal 10 upgrade to miniorange_2fa 8.x-4.7 [4]. Reported By: * Conrad Lara (cmlara) [5] Fixed By: * Sudhanshu Dhage (sudhanshu0542) [6] Coordinated By: * Greg Knaddison (greggles) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team [1] https://www.drupal.org/project/miniorange_2fa [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/miniorange_2fa/releases/5.2.0 [4] https://www.drupal.org/project/miniorange_2fa/releases/8.x-4.7 [5] https://www.drupal.org/u/cmlara [6] https://www.drupal.org/u/sudhanshu0542 [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/poker10

1 0

Enterprise MFA - TFA for Drupal - Critical - Access bypass - SA-CONTRIB-2025-055
by security-news＠drupal.org 07 May '25

07 May '25

View online: https://www.drupal.org/sa-contrib-2025-055 Project: Enterprise MFA - TFA for Drupal [1] Date: 2025-May-07 Security risk: *Critical* 18 ∕ 25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <4.7.0 || >=5.2.0 <5.2.0 || 5.0.* CVE IDs: CVE-2025-47709 Description: The module enables you to add second-factor authentication in addition to the default Drupal login. The module doesn't sufficiently protect certain sensitive routes, allowing an attacker to view or modify various TFA-related settings. Solution: Install the latest version: * If you use the Enterprise MFA - TFA for Drupal Drupal ^9.3, Drupal 10 and Drupal 11 upgrade to miniorange_2fa 5.2.0 [3]. * If you use the Enterprise MFA - TFA for Drupal Drupal 8, Drupal 9 and Drupal 10 upgrade to miniorange_2fa 8.x-4.7 [4]. Reported By: * Juraj Nemec (poker10) [5] of the Drupal Security Team Fixed By: * Sudhanshu Dhage (sudhanshu0542) [6] Coordinated By: * Juraj Nemec (poker10) [7] of the Drupal Security Team [1] https://www.drupal.org/project/miniorange_2fa [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/miniorange_2fa/releases/5.2.0 [4] https://www.drupal.org/project/miniorange_2fa/releases/8.x-4.7 [5] https://www.drupal.org/u/poker10 [6] https://www.drupal.org/u/sudhanshu0542 [7] https://www.drupal.org/u/poker10

1 0

Enterprise MFA - TFA for Drupal - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-054
by security-news＠drupal.org 07 May '25

07 May '25

View online: https://www.drupal.org/sa-contrib-2025-054 Project: Enterprise MFA - TFA for Drupal [1] Date: 2025-May-07 Security risk: *Critical* 18 ∕ 25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Request Forgery Affected versions: <4.7.0 || >=5.2.0 <5.2.0 || 5.0.* CVE IDs: CVE-2025-47708 Description: The module enables you to add second-factor authentication in addition to the default Drupal login. The module doesn't sufficiently protect certain routes from Cross Site Request Forgery (CSRF) attacks. Solution: Install the latest version: * If you use the Enterprise MFA - TFA for Drupal Drupal ^9.3, Drupal 10 and Drupal 11 upgrade to miniorange_2fa 5.2.0 [3]. * If you use the Enterprise MFA - TFA for Drupal Drupal 8, Drupal 9 and Drupal 10 upgrade to miniorange_2fa 8.x-4.7 [4]. Reported By: * Juraj Nemec (poker10) [5] of the Drupal Security Team Fixed By: * Sudhanshu Dhage (sudhanshu0542) [6] Coordinated By: * Juraj Nemec (poker10) [7] of the Drupal Security Team [1] https://www.drupal.org/project/miniorange_2fa [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/miniorange_2fa/releases/5.2.0 [4] https://www.drupal.org/project/miniorange_2fa/releases/8.x-4.7 [5] https://www.drupal.org/u/poker10 [6] https://www.drupal.org/u/sudhanshu0542 [7] https://www.drupal.org/u/poker10

1 0

Enterprise MFA - TFA for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2025-053
by security-news＠drupal.org 07 May '25

07 May '25

View online: https://www.drupal.org/sa-contrib-2025-053 Project: Enterprise MFA - TFA for Drupal [1] Date: 2025-May-07 Security risk: *Moderately critical* 13 ∕ 25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <4.7.0 || >=5.2.0 <5.2.0 || 5.0.* CVE IDs: CVE-2025-47707 Description: The module enables you to add second-factor authentication in addition to the default Drupal login. The module doesn't invoke two factor authentication (2FA) for the password reset option. This vulnerability is mitigated by the fact that an attacker must have access to the password reset link. Solution: Install the latest version: * If you use the Enterprise MFA - TFA for Drupal Drupal ^9.3, Drupal 10 and Drupal 11 upgrade to miniorange_2fa 5.2.0 [3]. * If you use the Enterprise MFA - TFA for Drupal Drupal 8, Drupal 9 and Drupal 10 upgrade to miniorange_2fa 8.x-4.7 [4]. Reported By: * Conrad Lara (cmlara) [5] Fixed By: * Sudhanshu Dhage (sudhanshu0542) [6] Coordinated By: * Greg Knaddison (greggles) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team [1] https://www.drupal.org/project/miniorange_2fa [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/miniorange_2fa/releases/5.2.0 [4] https://www.drupal.org/project/miniorange_2fa/releases/8.x-4.7 [5] https://www.drupal.org/u/cmlara [6] https://www.drupal.org/u/sudhanshu0542 [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/poker10

1 0

Enterprise MFA - TFA for Drupal - Moderately critical - Access bypass - SA-CONTRIB-2025-052
by security-news＠drupal.org 07 May '25

07 May '25

View online: https://www.drupal.org/sa-contrib-2025-052 Project: Enterprise MFA - TFA for Drupal [1] Date: 2025-May-07 Security risk: *Moderately critical* 14 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <4.7.0 || >=5.2.0 <5.2.0 || 5.0.* CVE IDs: CVE-2025-47706 Description: The module enables you to add second-factor authentication in addition to the default Drupal login. The module doesn't sufficiently check whether the TOTP token is already used or not for authenticator-based second-factor methods. This vulnerability is mitigated by the fact that an attacker must have a username, password and TOTP token generated within the last 5 minutes. Solution: Install the latest version: * If you use the Enterprise MFA - TFA for Drupal Drupal ^9.3, Drupal 10 and Drupal 11 upgrade to miniorange_2fa 5.2.0 [3]. * If you use the Enterprise MFA - TFA for Drupal Drupal 8, Drupal 9 and Drupal 10 upgrade to miniorange_2fa 8.x-4.7 [4]. Reported By: * Conrad Lara (cmlara) [5] Fixed By: * Sudhanshu Dhage (sudhanshu0542) [6] Coordinated By: * Greg Knaddison (greggles) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team [1] https://www.drupal.org/project/miniorange_2fa [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/miniorange_2fa/releases/5.2.0 [4] https://www.drupal.org/project/miniorange_2fa/releases/8.x-4.7 [5] https://www.drupal.org/u/cmlara [6] https://www.drupal.org/u/sudhanshu0542 [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/poker10

1 0

IFrame Remove Filter - Moderately critical - Cross site scripting - SA-CONTRIB-2025-051
by security-news＠drupal.org 07 May '25

07 May '25

View online: https://www.drupal.org/sa-contrib-2025-051 Project: IFrame Remove Filter [1] Date: 2025-May-07 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Affected versions: <2.0.5 CVE IDs: CVE-2025-47705 Description: This module enables you to add a filter to text formats (Full HTML, Filtered HTML), which will remove every iframe where the "src" is not on the allowlist. The module doesn't sufficiently filter these iframes in certain situations. This vulnerability is mitigated by the fact that an attacker must be able to edit content that allows iframes. Solution: Install the latest version: * If you use the IFrame Remove Filter module for Drupal 10.x or 11.x, upgrade to IFrame Remove Filter 2.0.5 [3] Reported By: * Pierre Rudloff (prudloff) [4] Fixed By: * Bálint Nagy (nagy.balint) [5] Coordinated By: * Greg Knaddison (greggles) [6] of the Drupal Security Team * Drew Webber (mcdruid) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team [1] https://www.drupal.org/project/iframeremove [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/iframeremove/releases/2.0.5 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/nagybalint [6] https://www.drupal.org/u/greggles [7] https://www.drupal.org/u/mcdruid [8] https://www.drupal.org/u/poker10

1 0