Security-news

security-news@drupal.org

1 participants
1782 discussions

Drupal Symfony Mailer Lite - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-014
by security-news＠drupal.org 28 Feb '24

28 Feb '24

View online: https://www.drupal.org/sa-contrib-2024-014 Project: Drupal Symfony Mailer Lite [1] Date: 2024-February-28 Security risk: *Moderately critical* 12∕25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Request Forgery Affected versions: <1.0.6 Description: The module doesn’t sufficiently protect against malicious links, which means an attacker can trick an administrator into performing unwanted actions. This vulnerability is mitigated by the fact that the set of unwanted actions is limited to specific configurations. Solution: Upgrade to Symfony Mailer Lite 1.0.6 [3] and rebuild Drupal's cache. Reported By: * Mingsong [4] Fixed By: * Lee Rowlands [5] of the Drupal Security Team * Wayne Eaker [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team * Juraj Nemec [8] of the Drupal Security Team * Lee Rowlands [9] of the Drupal Security Team [1] https://www.drupal.org/project/symfony_mailer_lite [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/symfony_mailer_lite/releases/1.0.6 [4] https://www.drupal.org/user/2986445 [5] https://www.drupal.org/user/395439 [6] https://www.drupal.org/user/326925 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/272316 [9] https://www.drupal.org/user/395439

1 0

Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-013
by security-news＠drupal.org 28 Feb '24

28 Feb '24

View online: https://www.drupal.org/sa-contrib-2024-013 Project: Node Access Rebuild Progressive [1] Date: 2024-February-28 Security risk: *Less critical* 9∕25 AC:Complex/A:Admin/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: This module provides an alternative mean of rebuilding the Content Access table. The module doesn't sufficiently reset the state of content access when the module is uninstalled. Solution: Install the latest version: * If you use the node_access_rebuild_progressive module for Drupal 7, upgrade to node_access_rebuild_progressive 7.x-1.2 [3] Reported By: * Jen Lampton [4] Provisional Member of the Drupal Security Team Fixed By: * Shelane French [5] * Juraj Nemec [6] of the Drupal Security Team * Jen Lampton [7] Provisional Member of the Drupal Security Team Coordinated By: * Greg Knaddison [8] of the Drupal Security Team * Juraj Nemec [9] of the Drupal Security Team [1] https://www.drupal.org/project/node_access_rebuild_progressive [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/node_access_rebuild_progressive/releases/7.x… [4] https://www.drupal.org/user/85586 [5] https://www.drupal.org/user/2674989 [6] https://www.drupal.org/user/272316 [7] https://www.drupal.org/user/85586 [8] https://www.drupal.org/user/36762 [9] https://www.drupal.org/user/272316

1 0

Private content - Moderately critical - Access bypass - SA-CONTRIB-2024-012
by security-news＠drupal.org 28 Feb '24

28 Feb '24

View online: https://www.drupal.org/sa-contrib-2024-012 Project: Private content [1] Date: 2024-February-28 Security risk: *Moderately critical* 12∕25 AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <2.1.0 Description: This module gives each node a 'private' checkbox. If it's set, the node can only be seen by the node author, or users with the 'access private content' permission. The module incorrectly grants access to private nodes under certain specific circumstances. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Access private content". Solution: Install the latest version: * If you use the Private Content module for Drupal 8.x, upgrade to Private Content 8.x-2.1 [3] Reported By: * kiwimind [4] Fixed By: * Adam Shepherd [5] Coordinated By: * Greg Knaddison [6] of the Drupal Security Team * Juraj Nemec [7] of the Drupal Security Team [1] https://www.drupal.org/project/private_content [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/private_content/releases/8.x-2.1 [4] https://www.drupal.org/user/749470 [5] https://www.drupal.org/user/2650563 [6] https://www.drupal.org/user/36762 [7] https://www.drupal.org/user/272316

1 0

Coffee - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-011
by security-news＠drupal.org 28 Feb '24

28 Feb '24

View online: https://www.drupal.org/sa-contrib-2024-011 Project: Coffee [1] Date: 2024-February-28 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Affected versions: <1.4.0 Description: The Coffee module helps you to navigate through the Drupal admin menus faster with a shortcut popup. The module doesn't sufficiently escape menu names when displaying them in the popup, thereby exposing a XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer menus and menu links". Solution: Install the latest version: * If you use the Coffee module for Drupal 10, upgrade to Coffee 8.x-1.4 [3] Reported By: * Patrick Fey [4] Fixed By: * Michael Mol [5] * Klaus Purer [6] * Oliver Köhler [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/coffee [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/coffee/releases/8.x-1.4 [4] https://www.drupal.org/user/998680 [5] https://www.drupal.org/user/919186 [6] https://www.drupal.org/user/262198 [7] https://www.drupal.org/user/1781874 [8] https://www.drupal.org/user/36762

1 0

Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-010
by security-news＠drupal.org 21 Feb '24

21 Feb '24

View online: https://www.drupal.org/sa-contrib-2024-010 Project: Node Access Rebuild Progressive [1] Date: 2024-February-21 Security risk: *Less critical* 9∕25 AC:Complex/A:Admin/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <2.0.2 Description: This module provides an alternative mean of rebuilding the Content Access table. The module doesn't sufficiently reset the state of content access when the module is uninstalled. Solution: Install the latest version: * If you use the node_access_rebuild_progressive module for Drupal 9.4+, upgrade to node_access_rebuild_progressive 2.0.2 [3] Reported By: * Pierre Rudloff [4] Fixed By: * Pierre Rudloff [5] * Shelane French [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team * Damien McKenna [8] of the Drupal Security Team [1] https://www.drupal.org/project/node_access_rebuild_progressive [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/node_access_rebuild_progressive/releases/2.0… [4] https://www.drupal.org/user/3611858 [5] https://www.drupal.org/user/3611858 [6] https://www.drupal.org/user/2674989 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/108450

1 0

CKEditor 4 LTS - WYSIWYG HTML editor - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-009
by security-news＠drupal.org 14 Feb '24

14 Feb '24

View online: https://www.drupal.org/sa-contrib-2024-009 Project: CKEditor 4 LTS - WYSIWYG HTML editor [1] Date: 2024-February-14 Security risk: *Moderately critical* 12∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross Site Scripting Affected versions: >=1.0.0 <1.0.1 Description: The CKEditor 4 LTS - WYSIWYG HTML editor module uses the CKEditor library for WYSIWYG editing. CKEditor has released a security update [3] that on certain configurations may impact the Drupal module that bundles and integrates this code. The vulnerability is mitigated by the fact it requires: 1) full-page editing [4] mode is enabled 2) or CDATA elements in Advanced Content Filtering configuration (defaults to script and style elements) are enabled. 3) An attacker must have a permission with access to the CKEditor instance. For more information, see CKEditor's security advisory: CVE-2024-24815 [5]: Cross-site scripting (XSS) vulnerability caused by incorrect CDATA detection Solution: Install the latest version: * If you use the CKEditor 4 LTS - WYSIWYG HTML editor module for Drupal 9.4+, upgrade to ckeditor_lts 1.0.1 [6] Reported By: * cilefen [7] of the Drupal Security Team * Juraj Nemec [8] of the Drupal Security Team Fixed By: * Wojciech Kukowski [9] * Jacek Bogdański [10] * Dawid [11] Coordinated By: * Greg Knaddison [12] of the Drupal Security Team * catch [13] of the Drupal Security Team [1] https://www.drupal.org/project/ckeditor_lts [2] https://www.drupal.org/security-team/risk-levels [3] https://ckeditor.com/cke4/release/CKEditor-4.24.0-LTS [4] https://ckeditor.com/docs/ckeditor4/latest/features/fullpage.html [5] https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-fq6h-4g8v-qq… [6] https://www.drupal.org/project/ckeditor_lts/releases/1.0.1 [7] https://www.drupal.org/user/1850070 [8] https://www.drupal.org/user/272316 [9] https://www.drupal.org/user/3104645 [10] https://www.drupal.org/user/3683355 [11] https://www.drupal.org/user/3741013 [12] https://www.drupal.org/user/36762 [13] https://www.drupal.org/user/35733

1 0

Migrate Tools - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-008
by security-news＠drupal.org 07 Feb '24

07 Feb '24

View online: https://www.drupal.org/sa-contrib-2024-008 Project: Migrate Tools [1] Date: 2024-February-07 Security risk: *Moderately critical* 12∕25 AC:Complex/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Request Forgery Affected versions: <6.0.3 Description: The Migrate Tools module provides tools for running and managing Drupal migrations. The module doesn't sufficiently protect against Cross Site Request Forgery under specific scenarios allowing an attacker to initiate a migration. This vulnerability is mitigated by the fact that an attacker must know the name of the migration. Solution: Install the latest version: * If you use the Migrate Tools module for Drupal 10, upgrade to Migrate Tools 6.0.3 [3] Reported By: * Andreas Hennings [4] Fixed By: * Andreas Hennings [5] * Lucas Hedding [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team [1] https://www.drupal.org/project/migrate_tools [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/migrate_tools/releases/6.0.3 [4] https://www.drupal.org/user/459338 [5] https://www.drupal.org/user/459338 [6] https://www.drupal.org/user/1463982 [7] https://www.drupal.org/user/36762

1 0

Entity Delete Log - Moderately critical - Access bypass - SA-CONTRIB-2024-007
by security-news＠drupal.org 31 Jan '24

31 Jan '24

View online: https://www.drupal.org/sa-contrib-2024-007 Project: Entity Delete Log [1] Date: 2024-January-31 Security risk: *Moderately critical* 12∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <1.1.1 Description: The Entity Delete Log module tracks the deletion of configured entity types, such as node or comments. It does not add sufficient permission to the log report page, allowing an attacker to view information from deleted entities. Solution: Install the latest version: * If you use the Entity Delete Log module for Drupal 9.x/10.x, upgrade to Entity Delete Log 1.1.1 [3] Note: This release updates the default permissions for the entity_delete_log view. After the update, you may want to review that permission if you already changed it from the default. Reported By: * Ryan Szrama [4] Fixed By: * Malay Nayak [5] * Virendra Singh [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team * Heine [8] of the Drupal Security Team * Benji Fisher [9] of the Drupal Security Team [1] https://www.drupal.org/project/entity_delete_log [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/entity_delete_log/releases/1.1.1 [4] https://www.drupal.org/user/49344 [5] https://www.drupal.org/user/3529755 [6] https://www.drupal.org/user/3652392 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/17943 [9] https://www.drupal.org/user/683300

1 0

Swift Mailer - Moderately critical - Access bypass - SA-CONTRIB-2024-006
by security-news＠drupal.org 24 Jan '24

24 Jan '24

View online: https://www.drupal.org/sa-contrib-2024-006 Project: Swift Mailer [1] Date: 2024-January-24 Security risk: *Moderately critical* 12∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Description: The Drupal Swift Mailer module extends the basic e-mail sending functionality provided by Drupal by delegating all e-mail handling to the Swift Mailer library. This enables your site to take advantage of the many features which the Swift Mailer library provides. The module could allow an attacker to gain widespread access to a Drupal site. This vulnerability is mitigated by the fact that an attacker must have a means to trigger sending an email with a body that they can control, which would requires either another contributed module or custom integration. Solution: Uninstall this module immediately. The swiftmailer library has been unsupported for a year, and this module is now also unsupported. Changing to a replacement module is suggested, the following were specifically suggested by the module maintainers: * Drupal Symfony Mailer Lite [3] * Drupal Symfony Mailer [4] Reported By: * Adam Shepherd [5] Fixed By: * Adam Shepherd [6] * Wayne Eaker [7] Coordinated By: * Damien McKenna [8] of the Drupal Security Team * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/swiftmailer [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/symfony_mailer_lite [4] https://www.drupal.org/project/symfony_mailer [5] https://www.drupal.org/user/2650563 [6] https://www.drupal.org/user/2650563 [7] https://www.drupal.org/user/326925 [8] https://www.drupal.org/user/108450 [9] https://www.drupal.org/user/36762

1 0

Open Social - Moderately critical - Information Disclosure - SA-CONTRIB-2024-005
by security-news＠drupal.org 24 Jan '24

24 Jan '24

View online: https://www.drupal.org/sa-contrib-2024-005 Project: Open Social [1] Date: 2024-January-24 Security risk: *Moderately critical* 13∕25 AC:None/A:User/CI:Some/II:None/E:Proof/TD:Default [2] Vulnerability: Information Disclosure Affected versions: <12.0.5 Description: Open Social is a Drupal distribution for online communities. The included optional social_group_flexible_group module doesn't sufficiently validate group updates. The lack of validation makes it possible to have content inside the group changing it's visibility, which could lead to that content being shown to a broader audience than intended. This vulnerability is mitigated by the fact the module social_group_flexible_group needs to be enabled. Solution: Install the latest version of Open Social: * If you use the Open Social distribution for Drupal 12.x, upgrade to Open Social 12.0.5 [3] Reported By: * Taras Kruts [4] Fixed By: * Taras Kruts [5] * Ronald te Brake [6] Coordinated By: * Damien McKenna [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/social [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/social/releases/12.0.5 [4] https://www.drupal.org/user/1449610 [5] https://www.drupal.org/user/1449610 [6] https://www.drupal.org/user/2314038 [7] https://www.drupal.org/user/108450 [8] https://www.drupal.org/user/36762

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news