Security-news

security-news@drupal.org

1 participants
1782 discussions

GraphQL - Moderately critical - Access bypass - SA-CONTRIB-2023-050
by security-news＠drupal.org 08 Nov '23

08 Nov '23

View online: https://www.drupal.org/sa-contrib-2023-050 Project: GraphQL [1] Date: 2023-November-08 Security risk: *Moderately critical* 11∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <3.4.0 || >=4.0.0 <4.6.0 Description: This module lets you craft and expose a GraphQL schema for Drupal 9 and 10. The module currently does not adequately verify whether a given user has the necessary permissions to access an entity's label creating an access bypass vulnerability. This vulnerability is mitigated by the fact that entity view and entity label access are usually handled by the same access check; developers have to opt-in for supporting different logic on entity types. Additionally your schema must make use of the EntityLabel DataProducer to be affected. Solution: Install the latest version: * If you use the GraphQL module v4 upgrade to GraphQL 8.x-4.6 [3] * If you use the GraphQL module v3 upgrade to GraphQL 8.x-3.4 [4] Reported By: * Dezső Biczó [5] Fixed By: * Dezső Biczó [6] * Klaus Purer [7] * Alexander Varwijk [8] * Luis [9] Coordinated By: * Greg Knaddison [10] of the Drupal Security Team [1] https://www.drupal.org/project/graphql [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/graphql/releases/8.x-4.6 [4] https://www.drupal.org/project/graphql/releases/8.x-3.4 [5] https://www.drupal.org/user/315522 [6] https://www.drupal.org/user/315522 [7] https://www.drupal.org/user/262198 [8] https://www.drupal.org/user/1868952 [9] https://www.drupal.org/user/1022312 [10] https://www.drupal.org/user/36762

1 0

Paragraphs admin - Moderately critical - - SA-CONTRIB-2023-049
by security-news＠drupal.org 01 Nov '23

01 Nov '23

View online: https://www.drupal.org/sa-contrib-2023-049 Project: Paragraphs admin [1] Date: 2023-November-01 Security risk: *Moderately critical* 14∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Affected versions: <1.5.0 Description: This module enables you to view all paragraph entities in an admin view. The module contains an access bypass that allows non admin users to access the view. The vulnerability can be mitigated by editing the view to change the permission required to access the page. Solution: Install the latest version: * If you use the paragraphs_admin module for Drupal 8.x, upgrade to paragraphs_admin 8.x-1.5 [3] Reported By: * Jen M [4] Fixed By: * Vladimir Roudakov [5] Coordinated By: * Lee Rowlands [6] of the Drupal Security Team * Greg Knaddison [7] of the Drupal Security Team * Damien McKenna [8] of the Drupal Security Team [1] https://www.drupal.org/project/paragraphs_admin [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/paragraphs_admin/releases/8.x-1.5 [4] https://www.drupal.org/user/3085703 [5] https://www.drupal.org/user/673120 [6] https://www.drupal.org/user/395439 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/108450

1 0

Drupal 9 is end of life - PSA-2023-11-01
by security-news＠drupal.org 01 Nov '23

01 Nov '23

View online: https://www.drupal.org/psa-2023-11-01 Date: 2023-November-01 Description: -------- DRUPAL 9 IS END OF LIFE AS OF NOVEMBER 1ST, 2023 -------------------- Drupal 9 relies on several other software projects, including Symfony, CKEditor, and Twig. With Symfony 4's end of life, CKEditor 4's end of life, and Twig 2's end of life all coming up soon, Drupal 9 went end of life on November 1st, 2023. There will be no further releases of Drupal 9. Two changes for Drupal contributed projects will occur before the end of January 2024. One is that the automated testing platform DrupalCI support for Drupal 9 will stop. The other is that release branches of contributed projects that only support Drupal 9 will be marked unsupported (see the tracking issue for details [1]). Thanks to everyone who helped create and maintain Drupal 9. -------- IT IS TIME TO UPDATE TO DRUPAL 10 COMPATIBLE RELEASES -------------- Check the documentation on updating a site to Drupal 10 [2]. If a contributed project is not yet compatible with Drupal 10, now is a good time to update it. Check for existing Drupal 10 compatibility issues relevant for your projects. If your project is already compatible with Drupal 10 but does not yet have a stable release, please tag a release, once you are confident in your project's stability. Where possible, tag a minor release supporting both Drupal 9 and 10 to ensure users have a smooth upgrade path. [1] https://www.drupal.org/project/drupalorg/issues/3398253 [2] https://www.drupal.org/docs/upgrading-drupal/upgrading-from-drupal-8-or-lat…

1 0

Mail Login - Moderately critical - Access bypass - SA-CONTRIB-2023-048
by security-news＠drupal.org 04 Oct '23

04 Oct '23

View online: https://www.drupal.org/sa-contrib-2023-048 Project: Mail Login [1] Date: 2023-October-04 Security risk: *Moderately critical* 13∕25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <2.9.0 Description: This module enables users to log in by email address with minimal configurations. Drupal core contains protection against brute force attacks via a flood control mechanism. This module's functionality did not replicate the flood control, enabling brute force attacks. A previous security advisory, SA-CONTRIB-2023-45 [3], was released for this issue, but that release did not successfully address the vulnerability. This security advisory and updated module version supersede the previous one. Solution: Install the latest version: * If you use the mail_login module for Drupal 8 or 9, upgrade to Mail Login 8.x-2.9 [4] Reported By: * Melisa Cordero [5] * Emil Johnsson [6] Fixed By: * Melisa Cordero [7] * Mohammad AlQanneh [8] * Lee Rowlands [9] of the Drupal Security Team * Emil Johnsson [10] Coordinated By: * Greg Knaddison [11] of the Drupal Security Team * Drew Webber [12] of the Drupal Security Team * xjm [13] of the Drupal Security Team * Juraj Nemec [14] of the Drupal Security Team * Neil Drumm [15] of the Drupal Security Team [1] https://www.drupal.org/project/mail_login [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/sa-contrib-2023-045 [4] https://www.drupal.org/project/mail_login/releases/8.x-2.9 [5] https://www.drupal.org/user/3655438 [6] https://www.drupal.org/user/1868992 [7] https://www.drupal.org/user/3655438 [8] https://www.drupal.org/user/2833163 [9] https://www.drupal.org/user/395439 [10] https://www.drupal.org/user/1868992 [11] https://www.drupal.org/user/36762 [12] https://www.drupal.org/user/255969 [13] https://www.drupal.org/user/65776 [14] https://www.drupal.org/u/poker10 [15] https://www.drupal.org/u/drumm

1 0

Content Moderation Notifications - Moderately critical - Information disclosure - SA-CONTRIB-2023-047
by security-news＠drupal.org 27 Sep '23

27 Sep '23

View online: https://www.drupal.org/sa-contrib-2023-047 Project: Content Moderation Notifications [1] Date: 2023-September-27 Security risk: *Moderately critical* 11∕25 AC:Complex/A:User/CI:Some/II:None/E:Proof/TD:All [2] Vulnerability: Information disclosure Affected versions: >=3.0.0 <3.6.0 Description: This module enables notifications to be sent to all users of a particular role, or to the content's author when a piece of content is transitioned from one state to another via core's content_moderation module. The module doesn't sufficiently check access to content when sending notifications. This vulnerability is mitigated by the fact that an attacker must have been assigned to receive notifications for the given content. Additionally, only data sent in the email is visible, so the attacker cannot access the content on the site. Solution: Install the latest version: * If you use the Content Moderation Notifications module for Drupal 8.x, upgrade to Content Moderation Notifications 8.x-3.6 [3]. Reported By: * lucasantunes [4] Fixed By: * Jonathan Hedstrom [5] * Luke Leber [6] * Rob Holmes [7] Coordinated By: * Jess [8] of the Drupal Security Team * Greg Knaddison [9] of the Drupal Security Team * Michael Hess [10] of the Drupal Security Team [1] https://www.drupal.org/project/content_moderation_notifications [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/content_moderation_notifications/releases/8.… [4] https://www.drupal.org/user/3603448 [5] https://www.drupal.org/user/208732 [6] https://www.drupal.org/user/3509746 [7] https://www.drupal.org/user/1774034 [8] https://www.drupal.org/user/65776 [9] https://www.drupal.org/user/36762 [10] https://www.drupal.org/user/102818

1 0

Entity cache - Critical - Information disclosure - SA-CONTRIB-2023-046
by security-news＠drupal.org 27 Sep '23

27 Sep '23

View online: https://www.drupal.org/sa-contrib-2023-046 Project: Entity cache [1] Date: 2023-September-27 Security risk: *Critical* 16∕25 AC:Basic/A:User/CI:All/II:All/E:Theoretical/TD:Uncommon [2] Vulnerability: Information disclosure Description: Entity Cache puts core entities into Drupal's cache API. A recent release of the module does not sanitize certain inputs appropriately. This can lead to unintended behavior when wildcard characters are included in the input. The impact of this bug should be relatively minor in most configurations, but in worst-case scenarios it could lead to significant Access Bypass. Solution: Install the latest version: * If you use the Entity cache module for Drupal 7.x, upgrade to Entity cache 7.x-1.7 [3]. Reported By: * Gary Sargent [4] Fixed By: * Damien McKenna [5] of the Drupal Security Team * Gary Sargent [6] * Drew Webber [7] of the Drupal Security Team * Jess [8] of the Drupal Security Team * Lee Rowlands [9] of the Drupal Security Team * Juraj Nemec [10] of the Drupal Security Team * Linus Cash [11] * Neil Hodgkinson [12] Coordinated By: * Damien McKenna [13] of the Drupal Security Team * Drew Webber [14] of the Drupal Security Team * Jess [15] of the Drupal Security Team * Greg Knaddison [16] of the Drupal Security Team [1] https://www.drupal.org/project/entitycache [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/entitycache/releases/7.x-1.7 [4] https://www.drupal.org/user/3783192 [5] https://www.drupal.org/user/108450 [6] https://www.drupal.org/user/3783192 [7] https://www.drupal.org/user/255969 [8] https://www.drupal.org/user/65776 [9] https://www.drupal.org/user/395439 [10] https://www.drupal.org/user/272316 [11] https://www.drupal.org/user/3783315 [12] https://www.drupal.org/user/3783314 [13] https://www.drupal.org/user/108450 [14] https://www.drupal.org/user/255969 [15] https://www.drupal.org/user/65776 [16] https://www.drupal.org/user/36762

1 0

Drupal core - Critical - Cache poisoning - SA-CORE-2023-006
by security-news＠drupal.org 20 Sep '23

20 Sep '23

View online: https://www.drupal.org/sa-core-2023-006 Project: Drupal core [1] Date: 2023-September-20 Security risk: *Critical* 16∕25 AC:Complex/A:None/CI:All/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cache poisoning Affected versions: >=8.7.0 <9.5.11 || >=10.0 <10.0.11 || >= 10.1 <10.1.4 Description: In certain scenarios, Drupal's JSON:API module will output error backtraces. With some configurations, this may cause sensitive information to be cached and made available to anonymous users, leading to privilege escalation. This vulnerability only affects sites with the JSON:API module enabled, and can be mitigated by uninstalling JSON:API. The core REST and contributed GraphQL modules are not affected. Drupal Steward [3] partners have been made aware of this issue. Some platforms may provide mitigations. However, not all WAF configurations can mitigate the issue, so it is still recommended to update promptly to this security release if your site uses JSON:API. Solution: Install the latest version: * If you are using Drupal 10.1, update to Drupal 10.1.4 [4]. * If you are using Drupal 10.0, update to Drupal 10.0.11 [5]. * If you are using Drupal 9.5, update to Drupal 9.5.11 [6]. All versions of Drupal 9 prior to 9.5 are end-of-life and do not receive security coverage. Note that Drupal 8 has reached its end of life [7]. Drupal 7 is not affected. Reported By: * ghostccamm [8] Fixed By: * Drew Webber [9] of the Drupal Security Team * Peter Wolanin [10] of the Drupal Security Team * Nathaniel Catchpole [11] of the Drupal Security Team * Alex Bronstein [12] of the Drupal Security Team * Lee Rowlands [13] of the Drupal Security Team * xjm [14] of the Drupal Security Team * Wim Leers [15] * Benji Fisher [16] of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/steward [4] https://www.drupal.org/project/drupal/releases/10.1.4 [5] https://www.drupal.org/project/drupal/releases/10.0.11 [6] https://www.drupal.org/project/drupal/releases/9.5.11 [7] https://www.drupal.org/psa-2021-06-29 [8] https://www.drupal.org/user/3778490 [9] https://www.drupal.org/user/255969 [10] https://www.drupal.org/user/49851 [11] https://www.drupal.org/user/35733 [12] https://www.drupal.org/user/78040 [13] https://www.drupal.org/user/395439 [14] https://www.drupal.org/user/65776 [15] https://www.drupal.org/user/99777 [16] https://www.drupal.org/user/683300

1 0

Mail Login - Critical - Access bypass - SA-CONTRIB-2023-045
by security-news＠drupal.org 13 Sep '23

13 Sep '23

View online: https://www.drupal.org/sa-contrib-2023-045 Project: Mail Login [1] Date: 2023-September-13 Security risk: *Critical* 16∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <2.8.0 Description: This module enables users to log in by email address with minimal configurations. Drupal core contains protection against brute force attacks via a flood control mechanism. This module's functionality did not replicate the flood control, enabling brute force attacks. Solution: Install the latest version: * If you use the mail_login module for Drupal 8 or 9, upgrade to Mail Login 8.x-2.8 [3] Reported By: * Melisa Cordero [4] Fixed By: * Melisa Cordero [5] * Mohammad AlQanneh [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team * xjm [8] of the Drupal Security Team [1] https://www.drupal.org/project/mail_login [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/mail_login/releases/8.x-2.8 [4] https://www.drupal.org/user/3655438 [5] https://www.drupal.org/user/3655438 [6] https://www.drupal.org/user/2833163 [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/xjm

1 0

WebProfiler - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-044
by security-news＠drupal.org 06 Sep '23

06 Sep '23

View online: https://www.drupal.org/sa-contrib-2023-044 Project: WebProfiler [1] Date: 2023-September-06 Security risk: *Moderately critical* 10∕25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross Site Scripting Affected versions: > 10.1.0 < 10.1.1 Description: The Webprofiler module provides a way of displaying the Symfony profile debugging tool at the bottom of each page. The abbr_class Twig filter can be used to bypass the Twig auto-escape feature. This vulnerability is mitigated by the fact that it is only exposed when the filter is specifically used in a theme to render content that contains an attack vector. Solution: Install the latest version: * If you use the WebProfiler module for Drupal 10x, upgrade to WebProfiler 10.1.1 [3] Reported By: * Pierre Rudloff [4] Fixed By: * Luca Lusso [5] * Pierre Rudloff [6] Coordinated By: * Damien McKenna [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/webprofiler [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webprofiler/releases/10.1.1 [4] https://www.drupal.org/user/3611858 [5] https://www.drupal.org/user/138068 [6] https://www.drupal.org/user/3611858 [7] https://www.drupal.org/user/108450 [8] https://www.drupal.org/user/36762

1 0

highlight.php - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-043
by security-news＠drupal.org 06 Sep '23

06 Sep '23

View online: https://www.drupal.org/sa-contrib-2023-043 Project: highlight.php [1] Date: 2023-September-06 Security risk: *Moderately critical* 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Scripting Affected versions: < 1.0.1 Description: Provides highlight.php [3] integration to Drupal, allowing blocks to be automatically highlighted with the correct language. The module's Twig function doesn't sufficiently filter user-entered data. Solution: Install the latest version: * If you use the highlight.php module, upgrade to highlight.php 1.0.1 [4] Reported By: * Pierre Rudloff [5] Fixed By: * Andrei Ivnitskii [6] * Pierre Rudloff [7] Coordinated By: * Benji Fisher [8] of the Drupal Security Team * Damien McKenna [9] of the Drupal Security Team * Greg Knaddison [10] of the Drupal Security Team [1] https://www.drupal.org/project/highlight_php [2] https://www.drupal.org/security-team/risk-levels [3] https://github.com/scrivo/highlight.php [4] https://www.drupal.org/project/highlight_php/releases/1.0.1 [5] https://www.drupal.org/user/3611858 [6] https://www.drupal.org/user/3547706 [7] https://www.drupal.org/user/3611858 [8] https://www.drupal.org/user/683300 [9] https://www.drupal.org/user/108450 [10] https://www.drupal.org/user/36762

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news