View online: https://www.drupal.org/sa-contrib-2024-045
Project: Monster Menus [1]
Date: 2024-October-09
Security risk: *Moderately critical* 13 ∕ 25
AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2]
Vulnerability: Access bypass, Information Disclosure
Affected versions: <9.3.2
Description:
This module enables you to group nodes within pages that have a
highly-granular, distributed permissions structure.
A function which can be used by third-party code does not return valid data
under certain rare circumstances. If the third-party code relies on this data
to decide whether to grant access to content, it may grant more access than
was intended.
This vulnerability is only present in sites that have custom code calling the
mm_content_get_uids_in_group() function with a single UID of zero (0) in the
second parameter.
Solution:
Install the latest version:
* If you use the monster_menus module for Drupal 7.x, upgrade to
monster_menus 7.x-1.34 [3].
* If you use the monster_menus module version *9.3.x*, upgrade to
monster_menus 9.3.2 [4].
* If you use the monster_menus module version *9.4.0 or newer*, no change
is
needed.
Reported By:
* Dan Wilga [5]
Fixed By:
* Dan Wilga [6]
* Ian McBride [7]
Coordinated By:
* Greg Knaddison [8] of the Drupal Security Team
* Juraj Nemec [9] of the Drupal Security Team
* Damien McKenna [10] of the Drupal Security Team
[1] https://www.drupal.org/project/monster_menus
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/monster_menus/releases/7.x-1.34
[4] https://www.drupal.org/project/monster_menus/releases/9.3.2
[5] https://www.drupal.org/user/56892
[6] https://www.drupal.org/user/56892
[7] https://www.drupal.org/user/539500
[8] https://www.drupal.org/u/greggles
[9] https://www.drupal.org/u/poker10
[10] https://www.drupal.org/u/damienmckenna
View online: https://www.drupal.org/sa-contrib-2024-042
Project: Diff [1]
Date: 2024-October-02
Security risk: *Moderately critical* 11 ∕ 25
AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:All [2]
Vulnerability: Access bypass, Information Disclosure
Affected versions: <1.8.0 || >=2.0.0 <2.0.0-beta3
Description:
This module adds a tab for sufficiently permissioned users. The tab shows all
revisions like standard Drupal but it also allows pretty viewing of all
added/changed/deleted words between revisions.
The module doesn't sufficiently check revision access before rendering a diff
report for 1) nodes or 2) general entities that support diff.
This vulnerability is mitigated by the fact that an attacker must have a role
with the permission from the general node permission to "view all revisions",
one of the more specific node type permissions, "view %bundle revisions" or
the equivalent for other general entity types.
Solution:
Install the latest version:
* If you use the Diff module for Drupal, upgrade to Diff 8.x-1.8 [3]
Reported By:
* Matthias Vogel [4]
Fixed By:
* Matthias Vogel [5]
* Lucas Hedding [6]
* Adam Bramley [7]
Coordinated By:
* Greg Knaddison [8] of the Drupal Security Team
* Juraj Nemec [9] of the Drupal Security Team
[1] https://www.drupal.org/project/diff
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/diff/releases/8.x-1.8
[4] https://www.drupal.org/user/3319139
[5] https://www.drupal.org/user/3319139
[6] https://www.drupal.org/user/1463982
[7] https://www.drupal.org/user/1036766
[8] https://www.drupal.org/u/greggles
[9] https://www.drupal.org/u/poker10