View online: https://www.drupal.org/sa-contrib-2024-018
Project: REST Views [1]
Date: 2024-April-24
Security risk: *Moderately critical* 14∕25
AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2]
Vulnerability: Information Disclosure
Affected versions: <3.0.1
Description:
The Rest views module lets site admins create rest exports in views with
additional options for serializing data.
This module does not accurately check access and may expose paths to
unpublished content.
This vulnerability is mitigated by the fact that there must be a specific
content structure to expose.
Paths to unpublished entities (such as nodes) will be exposed if those
entities are referenced from other entities listed in a REST display, and the
reference field on those listed entities is displayed with the "Entity path"
formatter.
Solution:
Install the latest version:
* REST Views 8.x-1.x versions are unsupported.
* REST Views 2.x versions upgrade to Rest Views 3.0.1 [3]
* REST Views 3.x versions prior to 3.0.1 upgrade to Rest Views 3.0.1 [4]
Reported By:
* nicxvan [5]
Fixed By:
* nicxvan [6]
Coordinated By:
* Benji Fisher [7] of the Drupal Security Team
* Greg Knaddison [8] of the Drupal Security Team
* Cathy Theys [9] of the Drupal Security Team
[1] https://www.drupal.org/project/rest_views
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/rest_views/releases/3.0.1
[4] https://www.drupal.org/project/rest_views/releases/3.0.1
[5] https://www.drupal.org/user/531480
[6] https://www.drupal.org/user/531480
[7] https://www.drupal.org/user/683300
[8] https://www.drupal.org/user/36762
[9] https://www.drupal.org/user/258568
View online: https://www.drupal.org/sa-contrib-2024-015
Project: Registration role [1]
Date: 2024-March-06
Security risk: *Critical* 18∕25
AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:Uncommon [2]
Vulnerability: Access bypass
Affected versions: <2.0.1
Description:
The Registration role module lets an administrator select a role (or multiple
roles) to automatically assign to new users. The selected role (or roles)
will be assigned to new registrants.
The module has a logic error when handling sites that upgraded code and did
not run the Drupal update process (e.g. update.php).
This vulnerability is mitigated by the fact that the problem does not exist
on sites that followed the process of updating code and running the standard
updates.
Solution:
Install the latest version:
* If you use the Registration role module version 2.x, upgrade to
Registration role 2.0.1 [3]
Review user accounts registered between 2023 July 11 and now for having
additional roles you did not intend for them to have. If your site missed or
reverted an update to configuration in the version 2.0.0 release of
Registration Role (or development branch from 2020 August 17 on),
non-selected roles were not removed from configuration. Without this update,
up until you re-saved the settings form or until you install the new release
- whichever came first - users who registered receive /all/ roles.
Also, upgrade to the latest version /and run update hooks/ at update.php or
with Drush, drush updb
OR: Immediately re-save the the configuration page at
/admin/people/registration-role
Reported By:
* Pamela Barone [4]
* Renaud Joubert [5]
Fixed By:
* Juraj Nemec [6] of the Drupal Security Team
* Benjamin Melançon [7]
Coordinated By:
* Juraj Nemec [8] of the Drupal Security Team
* Greg Knaddison [9] of the Drupal Security Team
* Drew Webber [10] of the Drupal Security Team
[1] https://www.drupal.org/project/registration_role
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/registration_role/releases/2.0.1
[4] https://www.drupal.org/user/1431110
[5] https://www.drupal.org/user/549974
[6] https://www.drupal.org/user/272316
[7] https://www.drupal.org/user/64383
[8] https://www.drupal.org/user/272316
[9] https://www.drupal.org/user/36762
[10] https://www.drupal.org/user/255969