Security-news

security-news@drupal.org

1 participants
1782 discussions

GridStack - Less critical - Cross Site Scripting - SA-CONTRIB-2023-024
by security-news＠drupal.org 28 Jun '23

28 Jun '23

View online: https://www.drupal.org/sa-contrib-2023-024 Project: GridStack [1] Version: 8.x-2.108.x-2.98.x-2.88.x-2.78.x-2.68.x-2.58.x-2.48.x-2.38.x-2.28.x-2.18.x-2.0 Date: 2023-June-28 Security risk: *Less critical* 7∕25 AC:Complex/A:Admin/CI:None/II:None/E:Exploit/TD:Uncommon [2] Vulnerability: Cross Site Scripting Description: This module enables you to create dynamic layouts and add sample color palettes for color selection hints via its UI. The module doesn't sufficiently sanitize the module's settings in certain scenarios leading to a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permissions "administer gridstack". Solution: Install the latest version: * If you use the GridStack module prior to version 8.x-2.11 for Drupal 9.x or 10.x, upgrade to GridStack 8.x-2.11 [3] Reported By: * Mitch Portier [4] Fixed By: * Gaus Surahman [5] * Mitch Portier [6] Coordinated By: * Damien McKenna [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/gridstack [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/gridstack/releases/8.x-2.11 [4] https://www.drupal.org/user/2284182 [5] https://www.drupal.org/user/159062 [6] https://www.drupal.org/user/2284182 [7] https://www.drupal.org/user/108450 [8] https://www.drupal.org/user/36762

1 0

GDPR Alert - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-023
by security-news＠drupal.org 28 Jun '23

28 Jun '23

View online: https://www.drupal.org/sa-contrib-2023-023 Project: GDPR Alert [1] Version: 1.0.0 Date: 2023-June-28 Security risk: *Moderately critical* 11∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross Site Scripting Affected versions: >=1.0 <1.0.1 Description: This module enables you to define configurable GDPR alert messages. The module doesn't sufficiently filter user-supplied text leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker needs additional permissions. The vulnerability can be exploited by an attacker with a role with the permission "administer gdpr alert" regardless of other configurations. Solution: Install the latest version: * If you use the GDPR alert module 1.0.0, upgrade to GDPR alert 1.0.1 [3] Reported By: * Mitch Portier [4] Fixed By: * George [5] * Mitch Portier [6] Coordinated By: * Damien McKenna [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/gdpr_alert [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/gdpr_alert/releases/1.0.1 [4] https://www.drupal.org/user/2284182 [5] https://www.drupal.org/user/1270728 [6] https://www.drupal.org/user/2284182 [7] https://www.drupal.org/user/108450 [8] https://www.drupal.org/user/36762

1 0

Civic Cookie Control - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-021
by security-news＠drupal.org 21 Jun '23

21 Jun '23

View online: https://www.drupal.org/sa-contrib-2023-021 Project: Civic Cookie Control [1] Date: 2023-June-21 Security risk: *Moderately critical* 11∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross Site Scripting Description: CivicCookieControl is a module that can help make a website compliant with EU and UK cookie legislation. The Civic GovUK Cookie Control module does not sufficiently sanitize the configuration resulting in a Cross-Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that the attacker must have a role with the "Administer Civic Cookie Control" permission. Solution: Install the latest version: * If you use the Civic Cookie Control module for Drupal 9.x, upgrade to Civic Cookie Control 4.4.13 [3] Reported By: * Mitch Portier [4] Fixed By: * Thanassis Perperis [5] * Mitch Portier [6] Coordinated By: * Damien McKenna [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/civicccookiecontrol [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/civicccookiecontrol/releases/4.4.13 [4] https://www.drupal.org/user/2284182 [5] https://www.drupal.org/user/2701781 [6] https://www.drupal.org/user/2284182 [7] https://www.drupal.org/user/108450 [8] https://www.drupal.org/user/36762

1 0

Album Photos - Critical - Access bypass - SA-CONTRIB-2023-022
by security-news＠drupal.org 21 Jun '23

21 Jun '23

View online: https://www.drupal.org/sa-contrib-2023-022 Project: Album Photos [1] Date: 2023-June-21 Security risk: *Critical* 15∕25 AC:None/A:Admin/CI:All/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Description: This module enables you to create and manage photos and photo albums on your website. The module doesn't sufficiently check node access when a user is provided the "edit any photo" or "delete any photo" permissions. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "edit any photo" or "delete any photo". Solution: Install the latest version: * If you use the 6.0.x version of the photos module for Drupal 9 or 10, upgrade to photos 6.0.4 [3] * If you use the 8.x version of the photos module for Drupal 9, upgrade to photos 8.x-4.5 [4] Reported By: * Marco Bouwer [5] Fixed By: * Nathaniel Burnett [6] * Marco Bouwer [7] Coordinated By: * Chris McCafferty [8] of the Drupal Security Team * Damien McKenna [9] of the Drupal Security Team * Greg Knaddison [10] of the Drupal Security Team [1] https://www.drupal.org/project/photos [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/photos/releases/6.0.4 [4] https://www.drupal.org/project/photos/releases/8.x-4.5 [5] https://www.drupal.org/user/1443348 [6] https://www.drupal.org/user/443482 [7] https://www.drupal.org/user/1443348 [8] https://www.drupal.org/user/1850070 [9] https://www.drupal.org/user/108450 [10] https://www.drupal.org/user/36762

1 0

Office Hours - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-020
by security-news＠drupal.org 14 Jun '23

14 Jun '23

View online: https://www.drupal.org/sa-contrib-2023-020 Project: Office Hours [1] Version: 8.x-1.58.x-1.48.x-1.38.x-1.28.x-1.18.x-1.0 Date: 2023-June-14 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: This module enables you to define a 'weekly office hours' field type, and add a field to any Content type, in order to display the weekly opening hours for a location. The module doesn't sufficiently filter user-supplied text leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker needs additional permissions. The vulnerability can be exploited by an attacker with a role with the permission "administer display" regardless of other configurations. In some scenarios, the vulnerability can be exploited by a user with "Create content" or "Edit content" for a relevant Content type. Solution: Install the latest version: * If you use the 'Office hours' module for Drupal 8.x, upgrade to office_hours 8.x-1.11 [3] Reported By: * John Voskuilen [4] * Mitch Portier [5] Fixed By: * John Voskuilen [6] * Mitch Portier [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/office_hours [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/office_hours/releases/8.x-1.11 [4] https://www.drupal.org/user/591042 [5] https://www.drupal.org/user/2284182 [6] https://www.drupal.org/user/591042 [7] https://www.drupal.org/user/2284182 [8] https://www.drupal.org/user/36762

1 0

End of life announcement and changes to Drupal 7 support - PSA-2023-06-07
by security-news＠drupal.org 07 Jun '23

07 Jun '23

View online: https://www.drupal.org/psa-2023-06-07 Date: 2023-June-07 Description: -------- DRUPAL 7'S END OF LIFE IS JANUARY 5, 2025 --------------------------- On February 23, 2022, we announced that we would be extending the End-of-Life for Drupal 7 until at least November 1, 2023. Today, we are officially announcing that Drupal 7 will reach its end of life on January 5, 2025. With this final extension, the Drupal Security Team is also adjusting the level of support provided. *This will be the final extension.* .... Reduced support for moderately critical Drupal 7 issues Effective August 1, 2023, the Drupal Security Team may choose to publicly post moderately critical and less critical issues affecting Drupal 7 in the public issue queue for resolution, as long as they are not mass-exploitable. (Security risk levels defined [1].) Drupal 9 and above are not affected by this change. When a security issue affects both Drupal 7 and Drupal 10, for example, the Drupal 10 security advisory may be released without a corresponding Drupal 7 fix, and the Drupal 7 issue made public at that point. .... Drupal 7 branches of unsupported modules are no longer eligible for new maintainership Community support for contributed modules will continue as it has to date. However, beginning August 1, 2023, once the Drupal 7 branch of a contributed module is marked unsupported it will not be eligible for new maintainership and will not be marked supported again. This will be true if an existing maintainer marks the module unsupported, or if the security team marks it unsupported for lack of response. If there are Drupal 7 modules that you or your clients rely on, then *we strongly encourage you to adopt these modules [2] proactively.* The Drupal security team will not issue security advisories for any unsupported libraries that Drupal 7 contributed modules rely on, such as CKEditor 4. .... PHP 5.5 and below will no longer be supported on Drupal 7 Effective August 1, 2023, we will no longer support PHP versions lower than 5.6 for Drupal 7. We may issue further PSAs increasing the minimum PHP requirement any time before Drupal 7's end of life. .... Security fixes will no longer be provided for Drupal 7 Windows-only issues Effective August 1, 2023, we will no longer provide Drupal 7 security fixes for Windows-only issues. If you are running a Drupal 7 site on Windows, you should look into migrating to another operating system for hosting your site. .... Drupal.org will no longer package Drupal 7 distributions Effective August 1, 2023, Drupal.org will no longer create Drupal 7 distribution packages with Drush make files. If you need a distribution built, you can use drush make locally. -------- THIS IS THE FINAL EXTENSION OF DRUPAL 7 COMMUNITY SUPPORT ----------- Current support is made possible thanks to the Drupal core maintainers, the Drupal Security Team, and organizations and volunteers who contribute to Drupal 7 issues. You can donate to support the work of the Drupal Security Team on our Security Team Donations [3] page. To learn more about sponsoring Drupal core maintainers and contributors, read xjm's blog post: Why sponsor a core committer? [4] -------- WHAT THE DRUPAL 7 END OF LIFE MEANS FOR YOU ------------------------- Once Drupal 7 reaches End of Life, this means: 1) The Drupal Security Team will no longer provide support or Security Advisories for Drupal 7 core and contributed modules. 2) Security issues for Drupal 7 may be disclosed in public, and zero-days (i.e, security vulnerabilities being exploited in the wild without advance warning) may occur. 3) Drupal.org will no longer support tasks related to Drupal 7 including documentation navigation, automated testing, packaging, etc 4) All Drupal 7-compatible releases on project pages will be flagged as not supported. 5) Some Drush functionality for Drupal 7 will stop working as the underlying Drupal.org infrastructure will be removed. 6) Drupal.org file archive packaging (tar and zip files) for Drupal 7 will be shut off. The archives may be removed. 7) There will be no more core commits on Drupal core 7.x. 8) Package tarballs may no longer be downloadable. 9) External vulnerability scans will flag Drupal 7 as insecure. If you are still maintaining a Drupal 7 site, we recommend migrating to Drupal 10 before the end of life date. .... Announcing the Drupal Association migration partners program The Drupal Association is working to certify migration partners to help Drupal 7 site owners. Certified Migration Partners will be promoted on Drupal.org, alongside a migration resource library, to any end users looking for help. Priority will be given to past extended support vendors and top contributors. To learn more about the Drupal 7 Certified Migration Partners visit the Drupal 7 EOL landing page [5] Coordinated By: The project lead, members of the Security team, and core committers contributed to this document. [1] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [2] https://www.drupal.org/docs/develop/managing-a-drupalorg-theme-module-or-di… [3] https://donorbox.org/drupal-security [4] https://xjmdrupal.org/blog/why-sponsor-a-core-committer [5] https://www.drupal.org/about/drupal-7/end-of-life

1 0

AddToAny Share Buttons - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-019
by security-news＠drupal.org 31 May '23

31 May '23

View online: https://www.drupal.org/sa-contrib-2023-019 Project: AddToAny Share Buttons [1] Date: 2023-May-31 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: This module provides social media share & follow buttons. The module doesn't sufficiently restrict AddToAny block settings to users who have permission to administer AddToAny. This allows users with lower permission to configure malicious code leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer blocks". Solution: Install the latest version: * If you use the AddToAny Share Buttons module for Drupal 9.4+ or 10, upgrade to AddToAny 2.0.4 [3] * If you use the AddToAny Share Buttons module for Drupal versions before 9.4, upgrade to AddToAny 8.x-1.21 [4] Reported By: * Mitch Portier [5] Fixed By: * micropat [6] * Vladimir Roudakov [7] * Mitch Portier [8] Coordinated By: * Damien McKenna [9] of the Drupal Security Team [1] https://www.drupal.org/project/addtoany [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/addtoany/releases/2.0.4 [4] https://www.drupal.org/project/addtoany/releases/8.x-1.21 [5] https://www.drupal.org/user/2284182 [6] https://www.drupal.org/user/260224 [7] https://www.drupal.org/user/673120 [8] https://www.drupal.org/user/2284182 [9] https://www.drupal.org/user/108450

1 0

AddToAny Share Buttons - Moderately critical - Access bypass - SA-CONTRIB-2023-018
by security-news＠drupal.org 31 May '23

31 May '23

View online: https://www.drupal.org/sa-contrib-2023-018 Project: AddToAny Share Buttons [1] Date: 2023-May-31 Security risk: *Moderately critical* 11∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Description: This module provides social media share & follow buttons. The module doesn't sufficiently check access to a node when retrieving the label of an AddToAny block. This vulnerability is mitigated by the fact it requires the node ID to be passed via the route, requiring another module or specific configuration to provide this ID, as the /node/{id} page doesn't provide this value on an access denied. Solution: Install the latest version: * If you use the AddToAny Share Buttons module for Drupal 9.4+ or 10, upgrade to AddToAny 2.0.4 [3] * If you use the AddToAny Share Buttons module for Drupal versions before 9.4, upgrade to AddToAny 8.x-1.21 [4] Reported By: * Mitch Portier [5] Fixed By: * Vladimir Roudakov [6] * micropat [7] * Mitch Portier [8] Coordinated By: * Damien McKenna [9] of the Drupal Security Team [1] https://www.drupal.org/project/addtoany [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/addtoany/releases/2.0.4 [4] https://www.drupal.org/project/addtoany/releases/8.x-1.21 [5] https://www.drupal.org/user/2284182 [6] https://www.drupal.org/user/673120 [7] https://www.drupal.org/user/260224 [8] https://www.drupal.org/user/2284182 [9] https://www.drupal.org/user/108450

1 0

Consent Popup - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-017
by security-news＠drupal.org 31 May '23

31 May '23

View online: https://www.drupal.org/sa-contrib-2023-017 Project: Consent Popup [1] Date: 2023-May-31 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: The Consent Popup provides a configurable popup that requires acceptance of a question before the visitor can continue, typically used for age consent. The module doesn't sufficiently sanitizes the text on the block leading to a cross site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create blocks. Solution: Install the latest version: * Upgrade to Consent Popup 1.0.3 [3] Reported By: * Mitch Portier [4] Fixed By: * Paulo Calado [5] * Mitch Portier [6] Coordinated By: * Damien McKenna [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/consent_popup [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/consent_popup/releases/1.0.3 [4] https://www.drupal.org/user/2284182 [5] https://www.drupal.org/user/3533061 [6] https://www.drupal.org/user/2284182 [7] https://www.drupal.org/user/108450 [8] https://www.drupal.org/user/36762

1 0

Iubenda Integration - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-016
by security-news＠drupal.org 31 May '23

31 May '23

View online: https://www.drupal.org/sa-contrib-2023-016 Project: Iubenda Integration [1] Date: 2023-May-31 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: The Iubenda Integration module provides a custom block to provide a link to the Iubenda privacy policy. On this block, a custom prefix and suffix text can be entered. The module does not sufficiently filter the block text fields on output, resulting in a Cross-Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to use the layout builder on content, edit the layout, or with the "Administer blocks" permission. Solution: Install the latest version: * If you use the Iubenda Integration module for Drupal 9+, upgrade to Iubenda Integration 4.0.1 [3] * If you use the Iubenda Integration module for Drupal 7, upgrade to Iubenda Integration 7.x-2.5 [4] Reported By: * Mitch Portier [5] Fixed By: * Roberto Peruzzo [6] * Mitch Portier [7] Coordinated By: * Damien McKenna [8] of the Drupal Security Team * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/iubenda_integration [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/iubenda_integration/releases/4.0.1 [4] https://www.drupal.org/project/iubenda_integration/releases/7.x-2.5 [5] https://www.drupal.org/user/2284182 [6] https://www.drupal.org/user/2661375 [7] https://www.drupal.org/user/2284182 [8] https://www.drupal.org/user/108450 [9] https://www.drupal.org/user/36762

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news