Security-news

security-news@drupal.org

1 participants
1782 discussions

Advanced Varnish - Moderately critical - Access bypass - SA-CONTRIB-2024-033
by security-news＠drupal.org 28 Aug '24

28 Aug '24

View online: https://www.drupal.org/sa-contrib-2024-033 Project: Advanced Varnish [1] Date: 2024-August-28 Security risk: *Moderately critical* 14∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <4.0.11 Description: This module enables you to cache pages for logged in users at the Varnish level. The Varnish bin names may be guessable when no hashing noise configuration is set on the module configuration page, which would ultimately allow any user to view cached pages that were intended for other roles when guessing such a bin name. Solution: *There are two steps.* Install the latest version and update your configuration: 1) If you use the Advanced Varnish module for Drupal 4.0.x, upgrade to Advanced Varnish 4.0.11 [3] 2) Go to the module configuration page and set an appropriate value to the hashing noise configuration. Reported By: * Heine Deelstra [4] of the Drupal Security Team Fixed By: * Heine Deelstra [5] of the Drupal Security Team * Alexander Shumenko [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team [1] https://www.drupal.org/project/adv_varnish [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/adv_varnish/releases/4.0.11 [4] https://www.drupal.org/user/17943 [5] https://www.drupal.org/user/17943 [6] https://www.drupal.org/user/2297432 [7] https://www.drupal.org/user/36762

1 0

Opigno - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-032
by security-news＠drupal.org 21 Aug '24

21 Aug '24

View online: https://www.drupal.org/sa-contrib-2024-032 Project: Opigno [1] Date: 2024-August-21 Security risk: *Critical* 16∕25 AC:Complex/A:User/CI:All/II:All/E:Theoretical/TD:Default [2] Vulnerability: Arbitrary PHP code execution Description: The Opigno module is related to Opigno LMS distribution. Opigno Scorm submodule exposes an API for extracting and handling SCORM packages. Uploaded files were not sufficiently validated to prevent arbitrary file uploads, which could lead to Remote Code Execution (RCE) and/or Cross Site Scripting (XSS). This vulnerability is mitigated by the fact that it affected only specific activity types. Solution: Install the latest version: * If you use the /opigno/ module, upgrade to opigno 7.x-1.23 [3] Reported By: * Yurii Boichenko [4] * Marcin Grabias [5] * catch [6] of the Drupal Security Team Fixed By: * Yurii Boichenko [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team * Juraj Nemec [9] of the Drupal Security Team [1] https://www.drupal.org/project/opigno [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/opigno/releases/7.x-1.23 [4] https://www.drupal.org/user/624860 [5] https://www.drupal.org/user/1599440 [6] https://www.drupal.org/user/35733 [7] https://www.drupal.org/user/624860 [8] https://www.drupal.org/user/36762 [9] https://www.drupal.org/u/poker10

1 0

Opigno TinCan Question Type - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-031
by security-news＠drupal.org 21 Aug '24

21 Aug '24

View online: https://www.drupal.org/sa-contrib-2024-031 Project: Opigno TinCan Question Type [1] Date: 2024-August-21 Security risk: *Critical* 16∕25 AC:Complex/A:User/CI:All/II:All/E:Theoretical/TD:Default [2] Vulnerability: Arbitrary PHP code execution Description: The Opigno TinCan Question Type module is related to Opigno LMS distribution. The module adds a new question type for the Quiz module. With this new question type, you will be able to import TinCan Packages to your Drupal instance and to use it as a question. Uploaded files were not sufficiently validated to prevent arbitrary file uploads, which could lead to Remote Code Execution (RCE) and/or Cross Site Scripting (XSS). This vulnerability is mitigated by the fact that it requires the attacker have a role with the permission to create or edit "TinCan Package" content type. Solution: Install the latest version: * If you use the /opigno_tincan_question_type/ module, upgrade to opigno_tincan_question_type 7.x-1.3 [3] Reported By: * Juraj Nemec [4] of the Drupal Security Team * Marcin Grabias [5] * catch [6] of the Drupal Security Team Fixed By: * Juraj Nemec [7] of the Drupal Security Team * Axel Minck [8] * Yurii Boichenko [9] Coordinated By: * Greg Knaddison [10] of the Drupal Security Team * Juraj Nemec [11] of the Drupal Security Team [1] https://www.drupal.org/project/opigno_tincan_question_type [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/opigno_tincan_question_type/releases/7.x-1.3 [4] https://www.drupal.org/user/272316 [5] https://www.drupal.org/user/1599440 [6] https://www.drupal.org/user/35733 [7] https://www.drupal.org/user/272316 [8] https://www.drupal.org/user/1065700 [9] https://www.drupal.org/user/624860 [10] https://www.drupal.org/user/36762 [11] https://www.drupal.org/u/poker10

1 0

Responsive and off-canvas menu - Moderately critical - Access bypass - SA-CONTRIB-2024-030
by security-news＠drupal.org 21 Aug '24

21 Aug '24

View online: https://www.drupal.org/sa-contrib-2024-030 Project: Responsive and off-canvas menu [1] Date: 2024-August-21 Security risk: *Moderately critical* 13∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <4.4.4 Description: This module integrates the mmenu library with Drupal's menu system with the aim of having an off-canvas mobile menu and a horizontal menu at wider widths. The module doesn't respect custom node access restrictions implemented through hook_ENTITY_TYPE_access hooks meaning the titles of restricted nodes can appear in the menu. Only sites with modules that implement hook_ENTITY_TYPE_access to restrict access to nodes are effected. Solution: Install the latest version: * If you use the 4.x branch of the responsive_menu module upgrade to 4.4.4 [3] Reported By: * collinhaines [4] Fixed By: * Stephen Cox [5] Coordinated By: * Greg Knaddison [6] of the Drupal Security Team * Juraj Nemec [7] of the Drupal Security Team * Drew Webber [8] of the Drupal Security Team [1] https://www.drupal.org/project/responsive_menu [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/responsive_menu/releases/4.4.4 [4] https://www.drupal.org/user/3532743 [5] https://www.drupal.org/user/2862323 [6] https://www.drupal.org/user/36762 [7] https://www.drupal.org/u/poker10 [8] https://www.drupal.org/u/mcdruid

1 0

Opigno group manager - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-027
by security-news＠drupal.org 07 Aug '24

07 Aug '24

View online: https://www.drupal.org/sa-contrib-2024-027 Project: Opigno group manager [1] Date: 2024-August-07 Security risk: *Critical* 16∕25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Arbitrary PHP code execution Affected versions: <3.1.1 Description: The Opigno group manager project is related to Opigno LMS distribution. It allows to build the contents of learning paths, by combining together modules, courses, and other activities, ordering them, and defining conditional rules for the transitions from one step to the next one. An administration form allows execution of arbitrary code. This issue is mitigated by several factors. First, it requires the attacker have the permission "update group learning_path". Additionally, it requires several steps and depends on other data in the system to be in place. Solution: Install the latest version: * If you use the opigno_group_manager module for Drupal 10.x, upgrade to opigno_group_manager 3.1.1 [3] Reported By: * catch [4] of the Drupal Security Team * Marcin Grabias [5] Fixed By: * Yurii Boichenko [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team * Benji Fisher [8] of the Drupal Security Team [1] https://www.drupal.org/project/opigno_group_manager [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/opigno_group_manager/releases/3.1.1 [4] https://www.drupal.org/user/35733 [5] https://www.drupal.org/user/1599440 [6] https://www.drupal.org/user/624860 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/683300

1 0

Opigno module - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-028
by security-news＠drupal.org 07 Aug '24

07 Aug '24

View online: https://www.drupal.org/sa-contrib-2024-028 Project: Opigno module [1] Date: 2024-August-07 Security risk: *Critical* 15∕25 AC:Complex/A:User/CI:All/II:All/E:Theoretical/TD:Uncommon [2] Vulnerability: Arbitrary PHP code execution Affected versions: <3.1.2 Description: The Opigno module is related to Opigno LMS distribution. It implements the module entity, that is a sub-part of a training. In the opigno_module module, uploaded files were not sufficiently validated to prevent arbitrary file uploads, which could lead to Remote Code Execution (RCE) and/or Cross Site Scripting (XSS). This vulnerability is mitigated by the fact that it requires the attacker have a role with the permission "create opigno tincan activities". Solution: Install the latest version: * If you use the /opigno_module/ module, upgrade to opigno_module >= 3.1.2 [3] Reported By: * Marcin Grabias [4] * catch [5] of the Drupal Security Team Fixed By: * Yurii Boichenko [6] * Axel Minck [7] * Yuriy Korzhov [8] * Andrii Aleksandrov [9] * catch [10] of the Drupal Security Team Coordinated By: * Greg Knaddison [11] of the Drupal Security Team [1] https://www.drupal.org/project/opigno_module [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/opigno_module/releases/3.1.2 [4] https://www.drupal.org/user/1599440 [5] https://www.drupal.org/user/35733 [6] https://www.drupal.org/user/624860 [7] https://www.drupal.org/user/1065700 [8] https://www.drupal.org/user/3477971 [9] https://www.drupal.org/user/3368060 [10] https://www.drupal.org/user/35733 [11] https://www.drupal.org/user/36762

1 0

Opigno Learning path - Critical - Arbitrary PHP code execution - SA-CONTRIB-2024-029
by security-news＠drupal.org 07 Aug '24

07 Aug '24

View online: https://www.drupal.org/sa-contrib-2024-029 Project: Opigno Learning path [1] Date: 2024-August-07 Security risk: *Critical* 16∕25 AC:Complex/A:User/CI:All/II:All/E:Theoretical/TD:Default [2] Vulnerability: Arbitrary PHP code execution Affected versions: <3.1.2 Description: The Opigno Learning Path module enables you to manage group content. Administrative forms allow uploading malicious files which may contain arbitrary code (RCE) or cross site scriptiong (XSS). These forms were not adequately controlled with permissions that communicate the severity of the permission. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Manage group content in any group". Solution: Install the latest version: * If you use the /opigno_learning_path module/, upgrade it to /opigno_learning_path/ >= 3.1.2 [3] Reported By: * Marcin Grabias [4] * catch [5] of the Drupal Security Team Fixed By: * Axel Minck [6] * Yuriy Korzhov [7] * Andrii Aleksandrov [8] * Yurii Boichenko [9] Coordinated By: * Greg Knaddison [10] of the Drupal Security Team [1] https://www.drupal.org/project/opigno_learning_path [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/opigno_learning_path/releases/3.1.2 [4] https://www.drupal.org/user/1599440 [5] https://www.drupal.org/user/35733 [6] https://www.drupal.org/user/1065700 [7] https://www.drupal.org/user/3477971 [8] https://www.drupal.org/user/3368060 [9] https://www.drupal.org/user/624860 [10] https://www.drupal.org/user/36762

1 0

View Password - Less critical - Cross Site Scripting - SA-CONTRIB-2024-026
by security-news＠drupal.org 31 Jul '24

31 Jul '24

View online: https://www.drupal.org/sa-contrib-2024-026 Project: View Password [1] Date: 2024-July-31 Security risk: *Less critical* 8∕25 AC:Basic/A:Admin/CI:None/II:None/E:Exploit/TD:Uncommon [2] Vulnerability: Cross Site Scripting Affected versions: <6.0.4 Description: The View Password module enables you to add a help icon button next to the password input field to toggle the password visibility. The administrative user is allowed to add classes to this icon for styling purposes. The module doesn't validate the content of classes. A malicious user with access to the View Password Settings Form could add malicious code in the classes field. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer view password". Solution: Install the latest version: * If you use the View Password module upgrade to View Password 6.0.4 [3]. Reported By: * Ide Braakman [4] Fixed By: * Ana Colautti [5] * Ide Braakman [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team * Juraj Nemec [8] of the Drupal Security Team [1] https://www.drupal.org/project/view_password [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/view_password/releases/6.0.4 [4] https://www.drupal.org/user/1879760 [5] https://www.drupal.org/user/2925043 [6] https://www.drupal.org/user/1879760 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/272316

1 0

3rd Party Libraries and Supply Chains - PSA-2024-06-26
by security-news＠drupal.org 26 Jun '24

26 Jun '24

View online: https://www.drupal.org/psa-2024-06-26 Date: 2024-June-26 Description: Following on from previous PSAs on 3rd Party code in the Drupal ecosystem: * PSA-2011-002 - External libraries and plugins [1] * Various 3rd Party Vulnerabilities - PSA-2019-09-04 | Drupal.org [2] It is the policy of the Drupal Security Team that site owners are responsible for monitoring and maintaining the security of 3rd party libraries. Supply chains are increasingly complex, and managing the associated risks is challenging. Website owners should actively manage their dependencies, potentially leveraging a Software Bill of Materials (SBOM) or scanner services. Other relevant tools include CSP [3] and SRI [4]. .... Concerns around polyfill.io The most recent case that has affected some contributed Drupal projects relates to the polyfill.io service. Recently, a new organization acquired and updated the polyfill.io service. The new service appears to be serving malicious content from the polyfill.io endpoints under specific circumstances. * https://thehackernews.com/2024/06/over-110000-websites-affected-by.html [5] * https://sansec.io/research/polyfill-supply-chain-attack [6] * https://github.com/polyfillpolyfill/polyfill-service/issues/2873 [7] In response to these concerns, several trusted providers of Javascript libraries are now also serving replacements for the polyfill.io service. Website owners should update their site to incorporate a newer, more reliable source for the polyfill.io files. * https://community.fastly.com/t/new-options-for-polyfill-io-users/2540 [8] * https://blog.cloudflare.com/polyfill-io-now-available-on-cdnjs-reduce-yo... [9] On the other hand, the polyfills may no longer be necessary in many cases, and it may be possible to remove them from sites rather than rely on a new source. Multiple Drupal projects utilize this service in various ways; several of which require code changes and new releases to switch to alternative providers. As this relates to 3rd party libraries, the Drupal Security Team will not be issuing Security Advisories for these projects and work has been done in the public issue queues [10] (note this may not be a complete list of all affected projects). There have been significant changes in the way that 3rd party code is utilized in the Drupal ecosystem since PSA-2011-002 linked to above, but the remit of the Drupal Security Team remains limited to code hosted on drupal.org’s systems. Reported By: * Heikki Ylipaavalniemi [11] * jpieper [12] * drupalam [13] Coordinated By: * Drew Webber [14] of the Drupal Security Team * Greg Knaddison [15] of the Drupal Security Team * Cathy Theys [16] of the Drupal Security Team * Juraj Nemec [17] of the Drupal Security Team * Michael Hess [18] of the Drupal Security Team [1] https://www.drupal.org/node/1189632 [2] https://www.drupal.org/psa-2019-09-04 [3] https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP [4] https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity [5] https://thehackernews.com/2024/06/over-110000-websites-affected-by.html [6] https://sansec.io/research/polyfill-supply-chain-attack [7] https://github.com/polyfillpolyfill/polyfill-service/issues/2873 [8] https://community.fastly.com/t/new-options-for-polyfill-io-users/2540 [9] https://blog.cloudflare.com/polyfill-io-now-available-on-cdnjs-reduce-your-… [10] https://www.drupal.org/project/issues/search?issue_tags=polyfill.io [11] https://www.drupal.org/user/3442607 [12] https://www.drupal.org/user/782988 [13] https://www.drupal.org/user/1076400 [14] https://www.drupal.org/user/255969 [15] https://www.drupal.org/user/36762 [16] https://www.drupal.org/user/258568 [17] https://www.drupal.org/user/272316 [18] https://www.drupal.org/user/102818

1 0

Acquia DAM - Moderately critical - Access bypass, Denial of Service - SA-CONTRIB-2024-025
by security-news＠drupal.org 05 Jun '24

05 Jun '24

View online: https://www.drupal.org/sa-contrib-2024-025 Project: Acquia DAM [1] Date: 2024-June-05 Security risk: *Moderately critical* 13∕25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass, Denial of Service Affected versions: <1.0.13 || >=1.1.0 <1.1.0-beta3 Description: Acquia DAM provides a connection to a third-party asset management system, allowing for images to be managed, linked to, and viewed from Drupal. In order for assets to be managed in Drupal, a site administrator must first authenticate the site to their DAM instance. The module doesn't sufficiently protect the ability to disconnect a site from DAM. While disconnected sites do not lose asset data in Drupal, it will prevent site editors from accessing the DAM until a site administrator re-authenticates the site. Some uncached media images may also fail to be fetched while disconnected. Solution: Install the latest version: * If you use the acquia_dam module for Drupal 9.4 or above, upgrade to Acquia DAM 1.0.13 [3]. * If you use a pre-release version of acquia_dam 1.1, upgrade to Acquia DAM 1.1.0-beta3 [4]. (Note: beta releases generally do not receive security coverage.) Reported By: * Matt Glaman [5] Fixed By: * Matt Glaman [6] * Greg Knaddison [7] of the Drupal Security Team * Balázs Ertl-Bakos [8] * Jakob Perry [9] Coordinated By: * Greg Knaddison [10] of the Drupal Security Team * xjm [11] of the Drupal Security Team [1] https://www.drupal.org/project/acquia_dam [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/acquia_dam/releases/1.0.13 [4] https://www.drupal.org/project/acquia_dam/releases/1.1.0-beta3 [5] https://www.drupal.org/user/2416470 [6] https://www.drupal.org/user/2416470 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/1086292 [9] https://www.drupal.org/user/45640 [10] https://www.drupal.org/user/36762 [11] https://www.drupal.org/user/65776

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news