Security-news

security-news@drupal.org

1 participants
1782 discussions

File Chooser Field - Moderately critical - Server Side Request Forgery, Information Disclosure - SA-CONTRIB-2023-015
by security-news＠drupal.org 17 May '23

17 May '23

View online: https://www.drupal.org/sa-contrib-2023-015 Project: File Chooser Field [1] Date: 2023-May-17 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:None/E:Exploit/TD:All [2] Vulnerability: Server Side Request Forgery, Information Disclosure Description: The File Chooser Field allows users to upload files using 3rd party plugins such as Google Drive and Dropbox. This module fails to validate user input sufficiently which could under certain circumstances lead to a Server Side Request Forgery (SSRF) vulnerability leading to Information Disclosure. In uncommon configurations and scenarios, it might lead to Remote Code Execution. Solution: * If you use File Chooser Field version 7.x-1.x, Upgrade to 7.x-1.13 [3] Reported By: * Drew Webber [4] of the Drupal Security Team * George Hazlewood [5] Fixed By: * Drew Webber [6] of the Drupal Security Team * aaron.ferris [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/file_chooser_field [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/file_chooser_field/releases/7.x-1.13 [4] https://www.drupal.org/user/255969 [5] https://www.drupal.org/user/2314 [6] https://www.drupal.org/user/255969 [7] https://www.drupal.org/user/1338234 [8] https://www.drupal.org/user/36762

1 0

S3 File System - Moderately critical - Access bypass - SA-CONTRIB-2023-014
by security-news＠drupal.org 03 May '23

03 May '23

View online: https://www.drupal.org/sa-contrib-2023-014 Project: S3 File System [1] Version: 8.x-3.18.x-3.08.x-3.0-rc28.x-3.0-rc18.x-3.0-beta78.x-3.0-beta68.x-3.0-beta58.x-3.0-beta48.x-3.0-beta38.x-3.0-beta28.x-3.0-beta18.x-3.0-alpha17 Date: 2023-May-03 Security risk: *Moderately critical* 13∕25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: S3 File System (s3fs) provides an additional file system to your Drupal site, which stores files in Amazon's Simple Storage Service (S3) or any other S3-compatible storage service. This module may fail to validate that a file being requested to be moved to storage was uploaded during the same web request, possibly allowing an attacker to move files that should normally be inaccessible to them. This vulnerability is mitigated by the fact that another vulnerability must already exist outside of s3fs. Solution: Install the latest version: * If you use the S3 File System module for Drupal 8.x, upgrade to s3fs 8.x-3.2 [3] Reported By: * Conrad Lara [4] Fixed By: * Conrad Lara [5] Coordinated By: * Greg Knaddison [6] of the Drupal Security Team [1] https://www.drupal.org/project/s3fs [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/s3fs/releases/8.x-3.2 [4] https://www.drupal.org/user/1790054 [5] https://www.drupal.org/user/1790054 [6] https://www.drupal.org/user/36762

1 0

Drupal core - Moderately critical - Access bypass - SA-CORE-2023-014
by security-news＠drupal.org 19 Apr '23

19 Apr '23

View online: https://www.drupal.org/sa-core-2023-014 Project: Drupal core [1] Date: 2023-April-19 Security risk: *Moderately critical* 13∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: The file download facility doesn't sufficiently sanitize file paths in certain situations. This may result in users gaining access to private files that they should not have access to. Some sites may require configuration changes following this security release. Review the release notes for your Drupal version if you have issues accessing private files after updating. This advisory *is* covered by Drupal Steward [3]. We would normally not apply for a release of this severity. However, in this case we have chosen to apply Drupal Steward security coverage to test our processes. .. Drupal 7 * All Drupal 7 sites on Windows web servers are vulnerable. * Drupal 7 sites on Linux web servers are vulnerable with certain file directory structures, or if a vulnerable contributed or custom file access module is installed. .. Drupal 9 and 10 Drupal 9 and 10 sites are only vulnerable if certain contributed or custom file access modules are installed. Solution: Install the latest version: * If you are using Drupal 10.0, update to Drupal 10.0.8 [4]. * If you are using Drupal 9.5, update to Drupal 9.5.8 [5]. * If you are using Drupal 9.4, update to Drupal 9.4.14 [6]. * If you are using Drupal 7, update to Drupal 7.96 [7]. All versions of Drupal 9 prior to 9.4.x are end-of-life and do not receive security coverage. Note that Drupal 8 has reached its end of life [8]. Reported By: * Heine [9] of the Drupal Security Team * Conrad Lara [10] * Guy Elsmore-Paddock [11] Fixed By: * Michael Hess [12] of the Drupal Security Team * Heine [13] of the Drupal Security Team * Lee Rowlands [14] of the Drupal Security Team * David Rothstein [15] of the Drupal Security Team * xjm [16] of the Drupal Security Team * Wim Leers [17] * Damien McKenna [18] of the Drupal Security Team * Alex Bronstein [19] of the Drupal Security Team * Conrad Lara [20] * Peter Wolanin [21] of the Drupal Security Team * Drew Webber [22] of the Drupal Security Team * Benji Fisher [23] of the Drupal Security Team * Juraj Nemec [24], provisional member of the Drupal Security Team * Jen Lampton [25], provisional member of the Drupal Security Team * Dave Long [26] of the Drupal Security Team * Kim Pepper [27] * Alex Pott [28] of the Drupal Security Team * Neil Drumm [29] of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/steward [4] https://www.drupal.org/project/drupal/releases/10.0.8 [5] https://www.drupal.org/project/drupal/releases/9.5.8 [6] https://www.drupal.org/project/drupal/releases/9.4.14 [7] https://www.drupal.org/project/drupal/releases/7.96 [8] https://www.drupal.org/psa-2021-06-29 [9] https://www.drupal.org/user/17943 [10] https://www.drupal.org/user/1790054 [11] https://www.drupal.org/user/156932 [12] https://www.drupal.org/user/102818 [13] https://www.drupal.org/user/17943 [14] https://www.drupal.org/user/395439 [15] https://www.drupal.org/user/124982 [16] https://www.drupal.org/user/65776 [17] https://www.drupal.org/user/99777 [18] https://www.drupal.org/user/108450 [19] https://www.drupal.org/user/78040 [20] https://www.drupal.org/user/1790054 [21] https://www.drupal.org/user/49851 [22] https://www.drupal.org/user/255969 [23] https://www.drupal.org/user/683300 [24] https://www.drupal.org/user/272316 [25] https://www.drupal.org/user/85586 [26] https://www.drupal.org/user/246492 [27] https://www.drupal.org/user/370574 [28] https://www.drupal.org/user/157725 [29] https://www.drupal.org/user/3064

1 0

Protected Pages - Critical - Access bypass - SA-CONTRIB-2023-013
by security-news＠drupal.org 12 Apr '23

12 Apr '23

View online: https://www.drupal.org/sa-contrib-2023-013 Project: Protected Pages [1] Date: 2023-April-12 Security risk: *Critical* 16∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: This module enables you to secure any page with a password. The module does not sufficiently restrict access to the page content. Solution: Install the latest version: * If you use the Protected Pages module for Drupal 8/9/10, upgrade to Protected Pages 8.x-1.6 [3] Reported By: * Shelane French [4] Fixed By: * Mark Dorison [5] * Diego Rodrigo da Silva [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team [1] https://www.drupal.org/project/protected_pages [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/protected_pages/releases/8.x-1.6 [4] https://www.drupal.org/user/2674989 [5] https://www.drupal.org/user/346106 [6] https://www.drupal.org/user/3719795 [7] https://www.drupal.org/user/36762

1 0

Xray Audit - Moderately critical - Cross site scripting - SA-CONTRIB-2023-012
by security-news＠drupal.org 29 Mar '23

29 Mar '23

View online: https://www.drupal.org/sa-contrib-2023-012 Project: Xray Audit [1] Date: 2023-March-29 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Description: This module is a tool for developers, analysts, and administrators that allows them to generate reports on a given Drupal installation. The module does not sufficiently sanitize some data presented in its reports. This vulnerability is mitigated by the fact that an attacker must have a role with permissions to administer an impacted content type. Solution: Install the latest version: * If you use the Xray Audit module for Drupal 9.x / 10.x, upgrade to Xray Audit v.1.1.1 [3] Reported By: * Conrad Lara [4] Fixed By: * Luis Peidró [5] Coordinated By: * Damien McKenna [6] of the Drupal Security Team * Greg Knaddison [7] of the Drupal Security Team * Chris McCafferty [8] of the Drupal Security Team [1] https://www.drupal.org/project/xray_audit [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/xray_audit/releases/1.1.1 [4] https://www.drupal.org/user/1790054 [5] https://www.drupal.org/user/3372326 [6] https://www.drupal.org/user/108450 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/1850070

1 0

Responsive media Image Formatter - Critical - Unsupported - SA-CONTRIB-2023-011
by security-news＠drupal.org 15 Mar '23

15 Mar '23

View online: https://www.drupal.org/sa-contrib-2023-011 Project: Responsive media Image Formatter [1] Date: 2023-March-15 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/responsive_media_image [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Media Responsive Thumbnail - Moderately critical - Information disclosure - SA-CONTRIB-2023-010
by security-news＠drupal.org 15 Mar '23

15 Mar '23

View online: https://www.drupal.org/sa-contrib-2023-010 Project: Media Responsive Thumbnail [1] Date: 2023-March-15 Security risk: *Moderately critical* 14∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Information disclosure Description: The Media Responsive Thumbnail module allows media reference fields to be rendered as a responsive image. This module does not properly check entity access prior to rendering media. This may result in users seeing thumbnails of media items they do not have access to. This release was coordinated with SA-CORE-2023-002 [3]. Solution: Install the latest version: * If you use the Media Responsive Thumbnail module, upgrade to Media Responsive Thumbnail 8.x-1.5 [4] Reported By: * Dan Flanagan [5] Fixed By: * Ivan Vidusenko [6] * Benji Fisher [7] of the Drupal Security Team Coordinated By: * Benji Fisher [8] of the Drupal Security Team * Lee Rowlands [9] of the Drupal Security Team * Joseph Zhao [10] Provisional Member of the Drupal Security Team * Greg Knaddison [11] of the Drupal Security Team * Dave Long [12] of the Drupal Security Team [1] https://www.drupal.org/project/media_responsive_thumbnail [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/sa-core-2023-002 [4] https://www.drupal.org/project/media_responsive_thumbnail/releases/8.x-1.5 [5] https://www.drupal.org/user/3615359 [6] https://www.drupal.org/user/2989799 [7] https://www.drupal.org/user/683300 [8] https://www.drupal.org/user/683300 [9] https://www.drupal.org/user/395439 [10] https://www.drupal.org/user/1987218 [11] https://www.drupal.org/user/36762 [12] https://www.drupal.org/user/246492

1 0

Drupal core - Moderately critical - Access bypass - SA-CORE-2023-004
by security-news＠drupal.org 15 Mar '23

15 Mar '23

View online: https://www.drupal.org/sa-core-2023-004 Project: Drupal core [1] Date: 2023-March-15 Security risk: *Moderately critical* 14∕25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <7.95 || >=8.0.0 <9.4.12 || >=9.5.0 <9.5.5 || >=10.0.0 <10.0.5 Description: Drupal core provides a page that outputs the markup from phpinfo() to assist with diagnosing PHP configuration. If an attacker was able to achieve an XSS exploit against a privileged user, they may be able to use the phpinfo page to access sensitive information that could be used to escalate the attack. This vulnerability is mitigated by the fact that a successful XSS exploit is required in order to exploit it. Solution: Install the latest version: * If you are using Drupal 10.0, update to Drupal 10.0.5 [3]. * If you are using Drupal 9.5, update to Drupal 9.5.5 [4]. * If you are using Drupal 9.4, update to Drupal 9.4.12 [5]. * If you are using Drupal 7, update to Drupal 7.95 [6]. All versions of Drupal 9 prior to 9.4.x are end-of-life and do not receive security coverage. Note that Drupal 8 has reached its end of life [7]. Reported By: * Elar Lang [8] Fixed By: * Damien McKenna [9] of the Drupal Security Team * Elar Lang [10] * Lee Rowlands [11] of the Drupal Security Team * Alex Bronstein [12] of the Drupal Security Team * Joseph Zhao [13] Provisional Member of the Drupal Security Team * Drew Webber [14] of the Drupal Security Team * Jen Lampton [15] Provisional Member of the Drupal Security Team * Nate Lampton [16] * Greg Knaddison [17] of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/drupal/releases/10.0.5 [4] https://www.drupal.org/project/drupal/releases/9.5.5 [5] https://www.drupal.org/project/drupal/releases/9.4.12 [6] https://www.drupal.org/project/drupal/releases/7.95 [7] https://www.drupal.org/psa-2021-06-29 [8] https://www.drupal.org/user/3583903 [9] https://www.drupal.org/user/108450 [10] https://www.drupal.org/user/3583903 [11] https://www.drupal.org/user/395439 [12] https://www.drupal.org/user/78040 [13] https://www.drupal.org/user/1987218 [14] https://www.drupal.org/user/255969 [15] https://www.drupal.org/user/85586 [16] https://www.drupal.org/user/35821 [17] https://www.drupal.org/user/36762

1 0

Drupal core - Moderately critical - Information Disclosure - SA-CORE-2023-003
by security-news＠drupal.org 15 Mar '23

15 Mar '23

View online: https://www.drupal.org/sa-core-2023-003 Project: Drupal core [1] Date: 2023-March-15 Security risk: *Moderately critical* 13∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Information Disclosure Affected versions: >=8.0.0 <9.4.12 || >=9.5.0 <9.5.5 || >=10.0.0 <10.0.5 Description: The language module provides a Language switcher block which can be placed to provide links to quickly switch between different languages. The URL of unpublished translations may be disclosed. When used in conjunction with a module like Pathauto, this may reveal the title of unpublished content. This advisory is not covered by Drupal Steward [3]. Solution: Install the latest version: * If you are using Drupal 10.0, update to Drupal 10.0.5 [4]. * If you are using Drupal 9.5, update to Drupal 9.5.5 [5]. * If you are using Drupal 9.4, update to Drupal 9.4.12 [6]. All versions of Drupal 9 prior to 9.4.x are end-of-life and do not receive security coverage. Note that Drupal 8 has reached its end of life [7]. Drupal 7 core does not include the Language module and therefore is not affected. The contributed modules for translation do not have the same code for language-switching links, so they are not affected, either. Reported By: * Jan Kellermann [8] Fixed By: * Jan Kellermann [9] * Lee Rowlands [10] of the Drupal Security Team * Greg Knaddison [11] of the Drupal Security Team * Benji Fisher [12] of the Drupal Security Team * Jess [13] of the Drupal Security Team * Sascha Grossenbacher [14] * Neil Drumm [15] of the Drupal Security Team * Dave Long [16] of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/steward [4] https://www.drupal.org/project/drupal/releases/10.0.5 [5] https://www.drupal.org/project/drupal/releases/9.5.5 [6] https://www.drupal.org/project/drupal/releases/9.4.12 [7] https://www.drupal.org/psa-2021-06-29 [8] https://www.drupal.org/user/371731 [9] https://www.drupal.org/user/371731 [10] https://www.drupal.org/user/395439 [11] https://www.drupal.org/user/36762 [12] https://www.drupal.org/user/683300 [13] https://www.drupal.org/user/65776 [14] https://www.drupal.org/user/214652 [15] https://www.drupal.org/user/3064 [16] https://www.drupal.org/user/246492

1 0

Drupal core - Moderately critical - Information Disclosure - SA-CORE-2023-002
by security-news＠drupal.org 15 Mar '23

15 Mar '23

View online: https://www.drupal.org/sa-core-2023-002 Project: Drupal core [1] Date: 2023-March-15 Security risk: *Moderately critical* 14∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Information Disclosure Affected versions: >=8.0.0 <9.4.12 || >=9.5.0 <9.5.5 || >=10.0.0 <10.0.5 Description: The Media module does not properly check entity access in some circumstances. This may result in users seeing thumbnails of media items they do not have access to, including for private files. This release was coordinated with SA-CONTRIB-2023-010 [3]. This advisory is not covered by Drupal Steward [4]. Solution: Install the latest version: * If you are using Drupal 10.0, update to Drupal 10.0.5 [5]. * If you are using Drupal 9.5, update to Drupal 9.5.5 [6]. * If you are using Drupal 9.4, update to Drupal 9.4.12 [7]. All versions of Drupal 9 prior to 9.4.x are end-of-life and do not receive security coverage. Note that Drupal 8 has reached its end of life [8]. Drupal 7 core does not include the Media Library module and therefore is not affected. Reported By: * James Williams [9] * Dan Flanagan [10] Fixed By: * Lee Rowlands [11] of the Drupal Security Team * James Williams [12] * Jess [13] of the Drupal Security Team * Dave Long [14] of the Drupal Security Team * Dan Flanagan [15] * Jen Lampton [16] Provisional Member of the Drupal Security Team * Joseph Zhao [17] Provisional Member of the Drupal Security Team * Benji Fisher [18] of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/sa-contrib-2023-010 [4] https://www.drupal.org/steward [5] https://www.drupal.org/project/drupal/releases/10.0.5 [6] https://www.drupal.org/project/drupal/releases/9.5.5 [7] https://www.drupal.org/project/drupal/releases/9.4.12 [8] https://www.drupal.org/psa-2021-06-29 [9] https://www.drupal.org/user/592268 [10] https://www.drupal.org/user/3615359 [11] https://www.drupal.org/user/395439 [12] https://www.drupal.org/user/592268 [13] https://www.drupal.org/user/65776 [14] https://www.drupal.org/user/246492 [15] https://www.drupal.org/user/3615359 [16] https://www.drupal.org/user/85586 [17] https://www.drupal.org/user/1987218 [18] https://www.drupal.org/user/683300

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news