- Security-news - lists.drupal.org

AI (Artificial Intelligence) - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-004
by security-news＠drupal.org 22 Jan '25

22 Jan '25

View online: https://www.drupal.org/sa-contrib-2025-004 Project: AI (Artificial Intelligence) [1] Date: 2025-January-22 Security risk: *Moderately critical* 14 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass, Information Disclosure Affected versions: <1.0.3 Description: The AI logging sub-module enables you to log AI requests and responses for debugging and auditing purposes. The module doesn't sufficiently check for access to view the preview listing of the logs. Full log details are correctly protected, and API keys are never logged. This vulnerability is mitigated by the fact that it only affects sites using the AI Logging sub-module with 'Log requests' enabled in the AI Logging configuration page. Solution: Install the latest version: * If you use AI 1.x, upgrade to AI 1.0.3 [3]. An update hook will update the view to use the view ai log permission. If you use version controlled configuration, remember to capture this. (or) Disable the AI Logging module. (or) Manually update the ai_logs view's access check to use the view ai log permission. Reported By: * Mingsong [4] Fixed By: * Scott Euser [5] * Marcus Johansson [6] * Andrew Belcher [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team * Juraj Nemec [9] of the Drupal Security Team * Dave Long [10] of the Drupal Security Team [1] https://www.drupal.org/project/ai [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ai/releases/1.0.3 [4] https://www.drupal.org/user/2986445 [5] https://www.drupal.org/user/3267594 [6] https://www.drupal.org/user/385947 [7] https://www.drupal.org/user/655282 [8] https://www.drupal.org/user/36762 [9] https://www.drupal.org/user/272316 [10] https://www.drupal.org/u/longwave

1 0

AI (Artificial Intelligence) - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-003
by security-news＠drupal.org 15 Jan '25

15 Jan '25

View online: https://www.drupal.org/sa-contrib-2025-003 Project: AI (Artificial Intelligence) [1] Date: 2025-January-15 Security risk: *Critical* 15 ∕ 25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Request Forgery Affected versions: >1.0.0 <1.0.2 Description: The Drupal AI module provides a framework for easily integrating Artificial Intelligence on any Drupal site using any kind of AI (from multiple vendors). The sub-modules AI Chatbot and AI Assistants API allow users to interact with the Drupal site via a 'chat' interface. The AI Chatbot module doesn't protect against Cross Site Request Forgeries in the Deepchat chatbot. This could allow an attacker to craft a scenario that can forge a request on behalf of a privileged user. When combined with the AI Search submodule, this could result in the AI Assistant exposing indexed data that the attacker should not have access to. When combined with the external AI Agent module, this could result in the AI Assistant exposing and allowing modification of site configuration of fields, content types, and vocabularies. Sites with custom built agents, with more privileged access, could be at greater risk from an exploit of this vulnerability. This vulnerability is mitigated by: * The targeted user needs to have an active session with a role with the "access deepchat api" permission and permission to assistants. * To extract data, the target site must have a permissive CORS policy allowing the attacking site to read the result of a cross origin request. * To modify data, the targeted user must have permission to use the configured agents. Solution: Install the latest version: * If you use the AI module, upgrade to AI 1.0.2 [3] If you cannot update, you can can uninstall the AI Chatbot sub-module. Reported By: * Marcus Johansson [4] Fixed By: * Marcus Johansson [5] * Michal Gow [6] * Kevin Quillen [7] * Andrew Belcher [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team * Drew Webber [10] of the Drupal Security Team * Juraj Nemec [11] of the Drupal Security Team [1] https://www.drupal.org/project/ai [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ai/releases/1.0.2 [4] https://www.drupal.org/user/385947 [5] https://www.drupal.org/user/385947 [6] https://www.drupal.org/user/3065779 [7] https://www.drupal.org/user/317279 [8] https://www.drupal.org/user/655282 [9] https://www.drupal.org/user/36762 [10] https://www.drupal.org/u/mcdruid [11] https://www.drupal.org//www.drupal.org/u/poker10

1 0

Profile Private - Critical - Unsupported - SA-CONTRIB-2025-002
by security-news＠drupal.org 08 Jan '25

08 Jan '25

View online: https://www.drupal.org/sa-contrib-2025-002 Project: Profile Private [1] Date: 2025-January-08 Security risk: *Critical* 15 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [4] Reported By: * Dezső Biczó [5] Coordinated By: * Ivo Van Geertruyen [6] of the Drupal Security Team * Cathy Theys [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/profile_private [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [4] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [5] https://security.drupal.org/user/86953 [6] https://www.drupal.org/u/mrbaileys [7] https://www.drupal.org/u/yesct [8] https://security.drupal.org/user/27

1 0

Email TFA - Moderately critical - Access bypass - SA-CONTRIB-2025-001
by security-news＠drupal.org 08 Jan '25

08 Jan '25

View online: https://www.drupal.org/sa-contrib-2025-001 Project: Email TFA [1] Date: 2025-January-08 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <2.0.3 Description: This module enables you to do Two-Factor Authentication by email, using a user registered email to send a verification code to the user's email every time the user tries to log in to your site. The module did not sufficiently protect against brute force attacks, allowing an attacker to bypass the second factor. This vulnerability is mitigated by the fact the attacker must be able to present the username and first factor (i.e. password). Solution: Install the latest version: * If you use the Email TFA module, upgrade to Email TFA 2.0.3 [3] Reported By: * Ursin Cola [4] Fixed By: * Ursin Cola [5] * abdulaziz zaid [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team * Juraj Nemec [8] of the Drupal Security Team [1] https://www.drupal.org/project/email_tfa [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/email_tfa/releases/2.0.3 [4] https://www.drupal.org/user/679260 [5] https://www.drupal.org/user/679260 [6] https://www.drupal.org/user/3585656 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/272316

1 0

Drupal 7 End of Life - PSA-2025-01-06
by security-news＠drupal.org 08 Jan '25

08 Jan '25

View online: https://www.drupal.org/psa-2025-01-06 Date: 2025-January-06 Description: Drupal core version 7 has reached end of life, and is no longer community supported on Drupal.org. This means that new releases of Drupal 7 core and contributed projects will no longer happen on Drupal.org and community support is no longer provided. *What this means for you:* 1) Any vulnerabilities that impact Drupal 7 may be released and made public without Security Advisories or warnings. Please continue to follow the process outlined in: Report a security issue [1] 2) Drupal 7 will no longer be supported. There will be no more core commits on Drupal 7.x to the official repository. The community will no longer be creating new Drupal 7 releases, fixing bugs in existing projects, writing documentation, etc. around Drupal 7. 3) The Drupal Security Team will no longer provide support or Security Advisories for Drupal 7 and Drupal-7-compatible contributed projects. 4) All Drupal 7 releases on project pages will be flagged as not supported. At some point in the future, update status and packages.drupal.org/7 will stop working for Drupal 7 sites. *Solution:* You can learn about upgrading Drupal and migrations [2] or read about other options [3]. [1] https://www.drupal.org/docs/develop/issues/issue-procedures-and-etiquette/r… [2] https://www.drupal.org/about/drupal-7/d7eol/diy [3] https://www.drupal.org/about/drupal-7/d7eol

1 0

Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-076
by security-news＠drupal.org 11 Dec '24

11 Dec '24

View online: https://www.drupal.org/sa-contrib-2024-076 Project: Open Social [1] Date: 2024-December-11 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <12.3.10 || >=12.4.0 <12.4.9 Description: Open Social is a Drupal distribution for online communities, which ships with a default (optional) module social_file_private to ensure the images and files provided by the distribution are stored in the private instead of the public filesystem. During updates from Open Social versions installed prior to 11.8.0 these files were not updated correctly and as a result the module didn't allow access checks to run correctly. Solution: Install the latest version and make sure to run the update hooks. * If you use Open Social 12.3.x upgrade to Open Social 12.3.10 [3] * If you use Open Social 12.4.x upgrade to Open Social 12.4.9 [4] Reported By: * corn696 [5] Fixed By: * corn696 [6] * Robert Ragas [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/social [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/social/releases/12.3.10 [4] https://www.drupal.org/project/social/releases/12.4.9 [5] https://www.drupal.org/user/3544002 [6] https://www.drupal.org/user/3544002 [7] https://www.drupal.org/user/2723261 [8] https://www.drupal.org/user/36762

1 0

Allow All File Extensions for file fields - Critical - Unsupported - SA-CONTRIB-2024-075
by security-news＠drupal.org 11 Dec '24

11 Dec '24

View online: https://www.drupal.org/sa-contrib-2024-075 Project: Allow All File Extensions for file fields [1] Date: 2024-December-11 Security risk: *Critical* 18 ∕ 25 AC:Basic/A:User/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [4] [1] https://www.drupal.org/project/all_extensions [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [4] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta…

1 0

Git Utilities for Drupal - Critical - Unsupported - SA-CONTRIB-2024-074
by security-news＠drupal.org 11 Dec '24

11 Dec '24

View online: https://www.drupal.org/sa-contrib-2024-074 Project: Git Utilities for Drupal [1] Date: 2024-December-11 Security risk: *Critical* 17 ∕ 25 AC:Basic/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Unsupported Affected versions: * Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai... [4] [1] https://www.drupal.org/project/git_utils [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta… [4] https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mainta…

1 0

Login Disable - Critical - Access bypass - SA-CONTRIB-2024-073
by security-news＠drupal.org 11 Dec '24

11 Dec '24

View online: https://www.drupal.org/sa-contrib-2024-073 Project: Login Disable [1] Date: 2024-December-11 Security risk: *Critical* 16 ∕ 25 AC:None/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: >=2.0.0 <2.1.1 Description: This module enables you to prevent existing users from logging in to your Drupal site unless they know the secret key to add to the end of the ?q=user login form page. The Login Disable module does not correctly prevent a user with a disabled login from logging in, allowing those users to by-pass the protection offered by the module. This vulnerability is mitigated by the fact that an attacker must already have a user account to log in. This bug therefore allows users to log in even if their login is disabled. Solution: Install the latest version: * If you use the Login Disable module for Drupal 9.x / 10.x, upgrade to Login Disable 2.1.1 [3] The Drupal 7 version of the module is not affected. Reported By: * e5sego [4] Fixed By: * e5sego [5] * Sang Lostrie [6] Coordinated By: * Ivo Van Geertruyen [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team * Benji Fisher [9] of the Drupal Security Team [1] https://www.drupal.org/project/login_disable [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/login_disable/releases/2.1.1 [4] https://www.drupal.org/user/261590 [5] https://www.drupal.org/user/261590 [6] https://www.drupal.org/user/2727459 [7] https://www.drupal.org/u/mrbaileys [8] https://security.drupal.org/user/27 [9] https://www.drupal.org/u/benjifisher

1 0

Browser Back Button - Moderately critical - Cross site scripting - SA-CONTRIB-2024-072
by security-news＠drupal.org 11 Dec '24

11 Dec '24

View online: https://www.drupal.org/sa-contrib-2024-072 Project: Browser Back Button [1] Date: 2024-December-11 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Affected versions: >=1.0.0 <2.0.2 Description: This module provides a block that renders a link providing the functionality of a browser's back button. The module does not sufficiently escape text entered by an administrator, resulting in a cross scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer blocks". Solution: Install the latest version: * If you use the Browser Back Button module for Drupal 9.x/10.x, upgrade to Browser Back Button 2.0.2 [3] Reported By: * Patrick Fey [4] Fixed By: * Elavarasan R [5] Coordinated By: * Ivo Van Geertruyen [6] of the Drupal Security Team [1] https://www.drupal.org/project/browser_back_button [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/browser_back_button/releases/2.0.2 [4] https://www.drupal.org/user/998680 [5] https://www.drupal.org/user/1902634 [6] https://www.drupal.org/u/mrbaileys

1 0