Security-news

security-news@drupal.org

1 participants
1782 discussions

Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-004
by security-news＠drupal.org 24 Jan '24

24 Jan '24

View online: https://www.drupal.org/sa-contrib-2024-004 Project: Open Social [1] Date: 2024-January-24 Security risk: *Moderately critical* 10∕25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <12.05 Description: Content within Open Social can have different visibilities. It is possible for a user to create public content even when this should not be allowed. This vulnerability is mitigated by the fact that the site must have public visibility disabled on a global level. Solution: Install the latest version of Open Social: * If you use the Open Social distribution for Drupal 12.x, upgrade to Open Social 12.0.5 [3] Reported By: * Corn696 [4] Fixed By: * Corn696 [5] * Tiago Siqueira [6] * Robert Ragas [7] Coordinated By: * Damien McKenna [8] of the Drupal Security Team * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/social [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/social/releases/12.0.5 [4] https://www.drupal.org/user/3544002 [5] https://www.drupal.org/user/3544002 [6] https://www.drupal.org/user/2822445 [7] https://www.drupal.org/user/2723261 [8] https://www.drupal.org/user/108450 [9] https://www.drupal.org/user/36762

1 0

Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2024-003
by security-news＠drupal.org 24 Jan '24

24 Jan '24

View online: https://www.drupal.org/sa-contrib-2024-003 Project: Two-factor Authentication (TFA) [1] Date: 2024-January-24 Security risk: *Moderately critical* 14∕25 AC:Complex/A:None/CI:Some/II:Some/E:Proof/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <1.5.0 Description: This module enables you to allow and/or require users to use a second authentication method in addition to password authentication. In some cases, the module allows users to log in with an authentication plugin that an administrator has disabled. This vulnerability is mitigated by the fact that an attacker must obtain a valid first-factor login credential, that an administrator must enable and then disable an authentication plugin, and that an attacker must obtain the valid second factor credential for the disabled plugin. Solution: Install the latest 8.x-1.2 version: * If you use the Two-factor Authentication (TFA) for Drupal 8, 9, or 10 upgrade to TFA 8.x-1.5 [3] After installing this update disabled plugins will no longer be offered or accepted as a second factor option. If an account is configured with only disabled plugins login will be prohibited and the the configured TFA "Help text" displayed instead of a second factor prompt. To allow access for a locked out user site owners may consider enabling the plugin (admin/config/people/tfa) or may use their existing procedures for granting access to accounts where the user has forgotten/lost their second factor tokens. Accounts with both enabled and disabled plugins will prompt the account owner with one of the remaining enabled plugins. Reported By: * Ide Braakman [4] Fixed By: * Conrad Lara [5] * Juraj Nemec [6] of the Drupal Security Team * João Ventura [7] Coordinated By: * Damien McKenna [8] of the Drupal Security Team * Greg Knaddison [9] of the Drupal Security Team * Benji Fisher [10] of the Drupal Security Team [1] https://www.drupal.org/project/tfa [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/tfa/releases/8.x-1.5 [4] https://www.drupal.org/user/1879760 [5] https://www.drupal.org/user/1790054 [6] https://www.drupal.org/user/272316 [7] https://www.drupal.org/user/122464 [8] https://www.drupal.org/user/108450 [9] https://www.drupal.org/user/36762 [10] https://www.drupal.org/user/683300

1 0

Drupal core - Moderately critical - Denial of Service - SA-CORE-2024-001
by security-news＠drupal.org 17 Jan '24

17 Jan '24

View online: https://www.drupal.org/sa-core-2024-001 Project: Drupal core [1] Date: 2024-January-17 Security risk: *Moderately critical* 11∕25 AC:None/A:None/CI:None/II:None/E:Theoretical/TD:Default [2] Vulnerability: Denial of Service Affected versions: >=8.0 <10.1.8 || >=10.2 <10.2.2 Description: The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS). Sites that do not use the Comment module are not affected. Solution: Install the latest version: * If you are using Drupal 10.2, update to Drupal 10.2.2 [3]. * If you are using Drupal 10.1, update to Drupal 10.1.8 [4]. All versions of Drupal 10 prior to 10.1 are end-of-life and do not receive security coverage. (Drupal 8 [5] and Drupal 9 [6] have both reached end-of-life.) Drupal 7 is not affected. Reported By: * Alexander Antonenko [7] * Doug Green [8] Fixed By: * Lee Rowlands [9] of the Drupal Security Team * Benji Fisher [10] of the Drupal Security Team * Juraj Nemec [11] of the Drupal Security Team * xjm [12] of the Drupal Security Team * Lauri Eskola [13], provisional member of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/drupal/releases/10.2.2 [4] https://www.drupal.org/project/drupal/releases/10.1.8 [5] https://www.drupal.org/psa-2021-06-29 [6] https://www.drupal.org/psa-2023-11-01 [7] https://www.drupal.org/user/225734 [8] https://www.drupal.org/user/29191 [9] https://www.drupal.org/user/395439 [10] https://www.drupal.org/user/683300 [11] https://www.drupal.org/user/272316 [12] https://www.drupal.org/user/65776 [13] https://www.drupal.org/user/1078742

1 0

Typogrify - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-002
by security-news＠drupal.org 10 Jan '24

10 Jan '24

View online: https://www.drupal.org/sa-contrib-2024-002 Project: Typogrify [1] Date: 2024-January-10 Security risk: *Moderately critical* 12∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross Site Scripting Affected versions: <1.3.0 Description: The Typogrify module brings the typographic refinements of Typogrify to Drupal. It provides a text filter and a Twig filter. The typogrify Twig filter can be used to bypass the Twig auto-escape feature, leading to a persistent Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that it is only exposed when the twig filter is specifically used in a template to render content. Solution: Install the latest version: * If you use the Typogrify module for Drupal 10.x, upgrade to Typogrify 8.x-1.3 [3] If you use the typogrify Twig filter provided by this module, then this update may cause double-encoding of text. See the updated README for best practices. Reported By: * Pierre Rudloff [4] Fixed By: * Benji Fisher [5] of the Drupal Security Team Coordinated By: * Damien McKenna [6] of the Drupal Security Team * Greg Knaddison [7] of the Drupal Security Team [1] https://www.drupal.org/project/typogrify [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/typogrify/releases/8.x-1.3 [4] https://www.drupal.org/user/3611858 [5] https://www.drupal.org/user/683300 [6] https://www.drupal.org/user/108450 [7] https://www.drupal.org/user/36762

1 0

File Entity (fieldable files) - Moderately critical - Cross Site Scripting, Access bypass - SA-CONTRIB-2024-001
by security-news＠drupal.org 10 Jan '24

10 Jan '24

View online: https://www.drupal.org/sa-contrib-2024-001 Project: File Entity (fieldable files) [1] Date: 2024-January-10 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting, Access bypass Description: File entity provides interfaces for managing files. It also extends the core file entity, allowing files to be fieldable, grouped into types, viewed (using display modes) and formatted using field formatters. The module previously did not sufficiently validate files under the scenario of a file replacement leading to multiple exploit paths including persistent Cross Site Scripting. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to edit files. Solution: Install the latest version: * If you use the file_entity module for Drupal 7.x, upgrade to File Entity 7.x-2.38 [3]. Reported By: * Caroline Boyden [4] Fixed By: * Joseph Olstad [5] * Sascha Grossenbacher [6] * Caroline Boyden [7] Coordinated By: * Damien McKenna [8] of the Drupal Security Team * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/file_entity [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/file_entity/releases/7.x-2.38 [4] https://www.drupal.org/user/657902 [5] https://www.drupal.org/user/1321830 [6] https://www.drupal.org/user/214652 [7] https://www.drupal.org/user/657902 [8] https://www.drupal.org/user/108450 [9] https://www.drupal.org/user/36762

1 0

Data Visualisation Framework - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-055
by security-news＠drupal.org 20 Dec '23

20 Dec '23

View online: https://www.drupal.org/sa-contrib-2023-055 Project: Data Visualisation Framework [1] Date: 2023-December-20 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Affected versions: < 2.0.2 Description: This module allows you to turn various data sources (Eg CSV or JSON file) into interactive visualisation. The DVF module provides a field (storage, widget & formatter) that can be added to any entity. This module uses two third-party JS libraries having from low to medium vulnerabilities. One of the vulnerabilities is a Cross Site Scripting vulnerability that may affect Drupal sites as a Persistent Cross Site Scripting vulnerability (i.e. not reflected). This release updates the libraries. The issue is mitigated by the fact an attacker needs the permission to create or edit content that is displayed using the Data Visualization Framework. Solution: Install the latest version: * If you use the Data Visualisation Framework for Drupal module (DVF for short), upgrade to dvf 2.0.2 [3] Reported By: * Joseph Zhao [4] Fixed By: * Joseph Zhao [5] Coordinated By: * Damien McKenna [6] of the Drupal Security Team * Greg Knaddison [7] of the Drupal Security Team * cilefen [8] of the Drupal Security Team * Lee Rowlands [9] of the Drupal Security Team [1] https://www.drupal.org/project/dvf [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/dvf/releases/2.0.2 [4] https://www.drupal.org/user/1987218 [5] https://www.drupal.org/user/1987218 [6] https://www.drupal.org/u/DamienMcKenna [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/u/cilefen [9] https://www.drupal.org//www.drupal.org/u/larowlan

1 0

Group - Less critical - Access bypass - SA-CONTRIB-2023-054
by security-news＠drupal.org 06 Dec '23

06 Dec '23

View online: https://www.drupal.org/sa-contrib-2023-054 Project: Group [1] Date: 2023-December-06 Security risk: *Less critical* 8∕25 AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: >=2.0.0 <2.2.2 || >=3.0.0 <3.2.2 Description: The Group module has the ability to make content private to specific groups. When viewing a list of entities, e.g. nodes, a visitor should only see those entities that are either not attached to a group or that they have group access to. The module doesn't sufficiently enforce list access under the scenario where two users have the same outsider and insider permissions, but are members of different groups without any individual roles being assigned to said memberships. In such a scenario, the permissions hash for both will be the same even though it should differ. This vulnerability is mitigated by the fact that an attacker must have the same hash as someone else, which is quite rare yet not unthinkable. Solution: Install the latest version: * Sites using Group version 2 should upgrade to Group v2.2.2 [3] * Sites using Group version 3 should upgrade to Group v3.2.2 [4] Reported By: * Dylan Donkersgoed [5] Fixed By: * Dylan Donkersgoed [6] * Péter Keszthelyi [7] * Austin Mitchell [8] * Ian Bullock [9] Coordinated By: * Damien McKenna [10] of the Drupal Security Team * Greg Knaddison [11] of the Drupal Security Team [1] https://www.drupal.org/project/group [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/group/releases/2.2.2 [4] https://www.drupal.org/project/group/releases/3.2.2 [5] https://www.drupal.org/user/2803351 [6] https://www.drupal.org/user/2803351 [7] https://www.drupal.org/user/1939064 [8] https://www.drupal.org/user/3534491 [9] https://www.drupal.org/user/1291942 [10] https://www.drupal.org/user/108450 [11] https://www.drupal.org/user/36762

1 0

Xsendfile - Moderately critical - Access bypass - SA-CONTRIB-2023-053
by security-news＠drupal.org 29 Nov '23

29 Nov '23

View online: https://www.drupal.org/sa-contrib-2023-053 Project: Xsendfile [1] Date: 2023-November-29 Security risk: *Moderately critical* 13∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <1.2.0 Description: The Xsendfile module enables fast transfer for private files in Drupal. In order to control private file downloads, the module overrides ImageStyleDownloadController, for which a vulnerability was disclosed in SA-CORE-2023-005 [3]. The Xsendfile module was still based on an insecure version of ImageStyleDownloadController. Solution: Install the latest version: * If you use the Xsendfile module for Drupal 8.x, upgrade to Xsendfile 8.x-1.2. [4] Reported By: * Pierre Rudloff [5] Fixed By: * Damien Norris [6] * Bruno De Bondt [7] * Pierre Rudloff [8] * Conrad Lara [9] Coordinated By: * Greg Knaddison [10] of the Drupal Security Team [1] https://www.drupal.org/project/xsendfile [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/sa-core-2023-005 [4] https://www.drupal.org/project/xsendfile/releases/8.x-1.2 [5] https://www.drupal.org/user/3611858 [6] https://www.drupal.org/user/97688 [7] https://www.drupal.org/user/33235 [8] https://www.drupal.org/user/3611858 [9] https://www.drupal.org/user/1790054 [10] https://www.drupal.org/user/36762

1 0

Mollie for Drupal - Moderately critical - Faulty payment confirmation logic - SA-CONTRIB-2023-052
by security-news＠drupal.org 15 Nov '23

15 Nov '23

View online: https://www.drupal.org/sa-contrib-2023-052 Project: Mollie for Drupal [1] Date: 2023-November-15 Security risk: *Moderately critical* 12∕25 AC:Complex/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Faulty payment confirmation logic Affected versions: <2.2.1 Description: This module enables you to pay online via Mollie. The module might not properly load the correct order to update the payment status when Mollie redirects to the redirect URL. This can allow an attacker to apply other people's orders to their own, getting credit without paying. This vulnerability is mitigated by the fact that an attacker must have some knowledge about the module's internal functionality. The issue only affects installations that use the Mollie for Drupal Commerce submodule. Solution: Install the latest version: * If you use the Mollie for Drupal module, upgrade to Mollie for Drupal 2.2.1 [3]. Reported By: * Rico Van de Vin [4] * Norbert Arends [5] Fixed By: * Rico Van de Vin [6] * hoporr [7] * Norbert Arends [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team * xjm [10] of the Drupal Security Team [1] https://www.drupal.org/project/mollie [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/mollie/releases/2.2.1 [4] https://www.drupal.org/user/1243726 [5] https://www.drupal.org/user/660798 [6] https://www.drupal.org/user/1243726 [7] https://www.drupal.org/user/444070 [8] https://www.drupal.org/user/660798 [9] https://www.drupal.org/user/36762 [10] https://www.drupal.org/u/xjm

1 0

GraphQL - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2023-051
by security-news＠drupal.org 08 Nov '23

08 Nov '23

View online: https://www.drupal.org/sa-contrib-2023-051 Project: GraphQL [1] Date: 2023-November-08 Security risk: *Moderately critical* 12∕25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Request Forgery Affected versions: <3.4.0 || >=4.0.0 <4.6.0 Description: The GraphQL module enables you to build GraphQL APIs which can include data fetching through Queries and data updates (create, update, delete) through mutations. The module does not sufficiently validate incoming requests that are made from domains other than the one serving the GraphQL endpoint. In case a user visits a malicious site, that site may make requests on the users behalf which can lead to the execution of mutations, exposing a CSRF vulnerability. Whether data is returned to the malicious site depends on your sites CORS configuration. This vulnerability is mitigated by the fact that a user with access to the API must have an active session cookie while visiting a malicious site. This vulnerability is also mitigated by restricting session cookies with the SameSite attribute (see solution below). Solution: Install the latest version: * If you use the GraphQL module v4 upgrade to GraphQL 8.x-4.6 [3] * If you use the GraphQL module v3 upgrade to GraphQL 8.x-3.4 [4] This vulnerability can also be mitigated by setting the SameSite attribute on session cookies to Lax (recommended) or Strict. This might not be suitable for sites that need to share the Drupal session cookie in some way with other sites. Set the following in your site's services.yml file: parameters: session.storage.options: # Session cookies are only used for backend admin accounts, so we restrict # the cookies to be used only from the backend origin. We don't use "Strict" # because that also removes cookies whenever an admin navigates from an # email or chat app, which is inconvenient. See # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie#samesi… cookie_samesite: Lax Reported By: * Sam Becker [5] Fixed By: * Sam Becker [6] * Klaus Purer [7] * Alexander Varwijk [8] * Luis [9] * Lee Rowlands [10] of the Drupal Security Team Coordinated By: * Greg Knaddison [11] of the Drupal Security Team * Damien McKenna [12] of the Drupal Security Team [1] https://www.drupal.org/project/graphql [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/graphql/releases/8.x-4.6 [4] https://www.drupal.org/project/graphql/releases/8.x-3.4 [5] https://www.drupal.org/user/1485048 [6] https://www.drupal.org/user/1485048 [7] https://www.drupal.org/user/262198 [8] https://www.drupal.org/user/1868952 [9] https://www.drupal.org/user/1022312 [10] https://www.drupal.org/user/395439 [11] https://www.drupal.org/user/36762 [12] https://www.drupal.org/user/108450

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news