- Security-news - lists.drupal.org

Gutenberg - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-048
by security-news＠drupal.org 09 Oct '24

09 Oct '24

View online: https://www.drupal.org/sa-contrib-2024-048 Project: Gutenberg [1] Date: 2024-October-09 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Request Forgery Affected versions: <2.13.0 || >=3.0.0 <3.0.5 Description: This module provides a new UI experience for node editing using the Gutenberg Editor library. The module did not sufficiently protect some routes against a Cross Site Request Forgery attack. This vulnerability is mitigated by the fact that the tricked user needs to have an active session with the "use gutenberg" permission. Solution: Install the latest version: * If you use the Gutenberg module versions 8.x-2.x, upgrade to Gutenberg 8.x-2.13 [3] * If you use the Gutenberg module versions 3.0.x, upgrade to Gutenberg 3.0.5 [4] Reported By: * Mingsong [5] Fixed By: * Mingsong [6] * Lee Rowlands [7] of the Drupal Security Team * Eirik Morland [8] * Stephan Zeidler [9] * Cathy Theys [10] of the Drupal Security Team * codebymikey [11] * Marco Fernandes [12] Coordinated By: * Greg Knaddison [13] of the Drupal Security Team * Juraj Nemec [14] of the Drupal Security Team [1] https://www.drupal.org/project/gutenberg [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/gutenberg/releases/8.x-2.13 [4] https://www.drupal.org/project/gutenberg/releases/3.0.5 [5] https://www.drupal.org/user/2986445 [6] https://www.drupal.org/user/2986445 [7] https://www.drupal.org/user/395439 [8] https://www.drupal.org/user/1014468 [9] https://www.drupal.org/user/767652 [10] https://www.drupal.org/user/258568 [11] https://www.drupal.org/user/3573206 [12] https://www.drupal.org/user/2127558 [13] https://www.drupal.org/u/greggles [14] https://www.drupal.org/u/poker10

1 0

Monster Menus - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-045
by security-news＠drupal.org 09 Oct '24

09 Oct '24

View online: https://www.drupal.org/sa-contrib-2024-045 Project: Monster Menus [1] Date: 2024-October-09 Security risk: *Moderately critical* 13 ∕ 25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass, Information Disclosure Affected versions: <9.3.2 Description: This module enables you to group nodes within pages that have a highly-granular, distributed permissions structure. A function which can be used by third-party code does not return valid data under certain rare circumstances. If the third-party code relies on this data to decide whether to grant access to content, it may grant more access than was intended. This vulnerability is only present in sites that have custom code calling the mm_content_get_uids_in_group() function with a single UID of zero (0) in the second parameter. Solution: Install the latest version: * If you use the monster_menus module for Drupal 7.x, upgrade to monster_menus 7.x-1.34 [3]. * If you use the monster_menus module version *9.3.x*, upgrade to monster_menus 9.3.2 [4]. * If you use the monster_menus module version *9.4.0 or newer*, no change is needed. Reported By: * Dan Wilga [5] Fixed By: * Dan Wilga [6] * Ian McBride [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team * Juraj Nemec [9] of the Drupal Security Team * Damien McKenna [10] of the Drupal Security Team [1] https://www.drupal.org/project/monster_menus [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/monster_menus/releases/7.x-1.34 [4] https://www.drupal.org/project/monster_menus/releases/9.3.2 [5] https://www.drupal.org/user/56892 [6] https://www.drupal.org/user/56892 [7] https://www.drupal.org/user/539500 [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://www.drupal.org/u/damienmckenna

1 0

Diff - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2024-042
by security-news＠drupal.org 02 Oct '24

02 Oct '24

View online: https://www.drupal.org/sa-contrib-2024-042 Project: Diff [1] Date: 2024-October-02 Security risk: *Moderately critical* 11 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass, Information Disclosure Affected versions: <1.8.0 || >=2.0.0 <2.0.0-beta3 Description: This module adds a tab for sufficiently permissioned users. The tab shows all revisions like standard Drupal but it also allows pretty viewing of all added/changed/deleted words between revisions. The module doesn't sufficiently check revision access before rendering a diff report for 1) nodes or 2) general entities that support diff. This vulnerability is mitigated by the fact that an attacker must have a role with the permission from the general node permission to "view all revisions", one of the more specific node type permissions, "view %bundle revisions" or the equivalent for other general entity types. Solution: Install the latest version: * If you use the Diff module for Drupal, upgrade to Diff 8.x-1.8 [3] Reported By: * Matthias Vogel [4] Fixed By: * Matthias Vogel [5] * Lucas Hedding [6] * Adam Bramley [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team * Juraj Nemec [9] of the Drupal Security Team [1] https://www.drupal.org/project/diff [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/diff/releases/8.x-1.8 [4] https://www.drupal.org/user/3319139 [5] https://www.drupal.org/user/3319139 [6] https://www.drupal.org/user/1463982 [7] https://www.drupal.org/user/1036766 [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10

1 0

Two-factor Authentication (TFA) - Critical - Access bypass - SA-CONTRIB-2024-043
by security-news＠drupal.org 02 Oct '24

02 Oct '24

View online: https://www.drupal.org/sa-contrib-2024-043 Project: Two-factor Authentication (TFA) [1] Date: 2024-October-02 Security risk: *Critical* 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <1.8.0 Description: This module enables you to allow and/or require users to use a second authentication method in addition to password authentication. The module does not sufficiently migrate sessions before prompting for a second factor token. This vulnerability is mitigated by the fact that an attacker must fixate a session on a victim system that is then authenticated with username and password without completing Two Factor authentication. An attacker must gather additional information regarding the entry form after authentication. An attacker must still present a valid token to complete authentication. Solution: Install the latest version: * If you use the Two-factor Authentication (TFA) module for Drupal 8+ upgrade to Two-factor Authentication (TFA) 8.x-1.8 [3] * If you use the Two-factor Authentication (TFA) module for Drupal 7 upgrade to Two-factor Authentication (TFA) 7.x-2.4 [4] Reported By: * Francesco Placella [5] Fixed By: * Francesco Placella [6] * Juraj Nemec [7] of the Drupal Security Team * Conrad Lara [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team * Juraj Nemec [10] of the Drupal Security Team [1] https://www.drupal.org/project/tfa [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/tfa/releases/8.x-1.8 [4] https://www.drupal.org/project/tfa/releases/7.x-2.4 [5] https://www.drupal.org/user/183211 [6] https://www.drupal.org/user/183211 [7] https://www.drupal.org/user/272316 [8] https://www.drupal.org/user/1790054 [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/poker10

1 0

Persistent Login - Moderately critical - Access bypass - SA-CONTRIB-2024-044
by security-news＠drupal.org 02 Oct '24

02 Oct '24

View online: https://www.drupal.org/sa-contrib-2024-044 Project: Persistent Login [1] Date: 2024-October-02 Security risk: *Moderately critical* 11 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <1.8.0 || >=2.2.0 <2.2.2 || 2.0.* || 2.1.* Description: This module enables users to remain logged in separately from session timeouts. The module doesn't sufficiently check a user's disabled status when validating cookies. This vulnerability is mitigated by the fact that an attacker must have an unexpired cookie from a previous successful login. Solution: Install the latest version: * If you use the Persistent Login 8.x-1.x, upgrade to Persistent Login 8.x-1.8 [3] * If you use the Persistent Login 2.x, upgrade to Persistent Login 2.2.2 [4] Reported By: * Geoff Appleby [5] Fixed By: * Geoff Appleby [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team * Juraj Nemec [8] of the Drupal Security Team * Drew Webber [9] of the Drupal Security Team [1] https://www.drupal.org/project/persistent_login [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/persistent_login/releases/8.x-1.8 [4] https://www.drupal.org/project/persistent_login/releases/2.2.2 [5] https://www.drupal.org/user/490940 [6] https://www.drupal.org/user/490940 [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/poker10 [9] https://www.drupal.org/u/mcdruid

1 0

Smart IP Ban - Critical - Access bypass - SA-CONTRIB-2024-041
by security-news＠drupal.org 18 Sep '24

18 Sep '24

View online: https://www.drupal.org/sa-contrib-2024-041 Project: Smart IP Ban [1] Date: 2024-September-18 Security risk: *Critical* 18 ∕ 25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: The Smart IP Ban module enables a site to automatically ban an IP address based upon too many failed authentications. The module doesn't sufficiently protect access to certain paths provided by the module allowing a malicious user to view and modify the settings. Solution: Install the latest version: * If you use the Smart IP Ban module for Drupal 7.x, upgrade to Smart IP Ban 7.x-1.1 [3] Reported By: * Shawn Gants [4] Fixed By: * Sivaji Ganesh Jojodae [5] Coordinated By: * Greg Knaddison [6] of the Drupal Security Team * Damien McKenna [7] of the Drupal Security Team * Juraj Nemec [8] of the Drupal Security Team [1] https://www.drupal.org/project/smart_ip_ban [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/smart_ip_ban/releases/7.x-1.1 [4] https://www.drupal.org/user/2351786 [5] https://www.drupal.org/user/328724 [6] https://www.drupal.org/user/36762 [7] https://www.drupal.org/u/DamienMcKenna [8] https://www.drupal.org/u/poker10

1 0

File Entity (fieldable files) - Moderately critical - Information Disclosure - SA-CONTRIB-2024-040
by security-news＠drupal.org 11 Sep '24

11 Sep '24

View online: https://www.drupal.org/sa-contrib-2024-040 Project: File Entity (fieldable files) [1] Date: 2024-September-11 Security risk: *Moderately critical* 10 ∕ 25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Information Disclosure Description: This module enables you to store and manage both private and public files, provides the ability to add fieldable metadata for file_entity bundle types in addition to core file_managed data. The module doesn't sufficiently ensure private destination folders exist prior to writing to them. If the folder doesn't exist, the module places the file in a publicly accessible directory. This vulnerability only affects sites with private files. Solution: Install the latest version: * If you use the file_entity module for Drupal 7, upgrade to file_entity 7.x-2.39 [3] or newer. Reported By: * Devin Zuczek [4] Fixed By: * Devin Zuczek [5] * Joseph Olstad [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team * Damien McKenna [8] of the Drupal Security Team * Juraj Nemec [9] of the Drupal Security Team [1] https://www.drupal.org/project/file_entity [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/file_entity/releases/7.x-2.39 [4] https://www.drupal.org/user/701754 [5] https://www.drupal.org/user/701754 [6] https://www.drupal.org/user/1321830 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/u/DamienMcKenna [9] https://www.drupal.org/u/poker10

1 0

Security Kit - Less critical - Denial of Service - SA-CONTRIB-2024-039
by security-news＠drupal.org 11 Sep '24

11 Sep '24

View online: https://www.drupal.org/sa-contrib-2024-039 Project: Security Kit [1] Date: 2024-September-11 Security risk: *Less critical* 9 ∕ 25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:Default [2] Vulnerability: Denial of Service Affected versions: <2.0.3 Description: This module provides Drupal with various security-hardening options, for example by emitting various configurable HTTP response headers. The module doesn't sufficiently validate input in Content Security Policy (CSP) violation reports. This can cause errors when a logging module (e.g. dblog or syslog) attempts to parse the resulting log message which contains invalid data. This vulnerability is mitigated by the fact that to be affected a site must have seckit's CSP reporting functionality enabled. Recent versions of Drupal 10 and 11 core are not vulnerable due to improved parsing of log messages [3]. Solution: Install the latest version: * If you use the 7.x-1.x branch of the seckit module, upgrade to seckit 7.x-1.13 [4] * If you use the 2.0.x branch of the seckit module, upgrade to seckit 2.0.3 [5] Reported By: * _b0lli [6] Fixed By: * jweowu [7] * Drew Webber [8] of the Drupal Security Team Coordinated By: * Greg Knaddison [9] of the Drupal Security Team * Drew Webber [10] of the Drupal Security Team * Heine Deelstra [11] of the Drupal Security Team [1] https://www.drupal.org/project/seckit [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/drupal/issues/2481349 [4] https://www.drupal.org/project/seckit/releases/7.x-1.13 [5] https://www.drupal.org/project/seckit/releases/2.0.3 [6] https://www.drupal.org/user/3827467 [7] https://www.drupal.org/user/152788 [8] https://www.drupal.org/user/255969 [9] https://www.drupal.org/u/greggles [10] https://www.drupal.org/u/mcdruid [11] https://www.drupal.org/user/17943

1 0

Open Social - Moderately critical - Denial of Service - SA-CONTRIB-2024-038
by security-news＠drupal.org 04 Sep '24

04 Sep '24

View online: https://www.drupal.org/sa-contrib-2024-038 Project: Open Social [1] Date: 2024-September-04 Security risk: *Moderately critical* 10∕25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:All [2] Vulnerability: Denial of Service Affected versions: <12.3.8 || >=12.4.0 <12.4.5 || >=13.0.0 <13.0.0-alpha11 Description: Open Social is a Drupal distribution for online communities. The distribution didn't validate the flood control limits on the password reset form correctly resulting in a potential attacker flooding the password reset which could result in a Denial of Service. Fortunately the message does not disclose any information to the attacker. Solution: Install the latest version: * If you use Open Social 12.3.x, upgrade to Open Social 12.3.8 [3] * If you use Open Social 12.4.x, upgrade to Open Social 12.4.5 [4] Reported By: * vnech [5] Fixed By: * Ronald te Brake [6] * vnech [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team * Juraj Nemec [9] of the Drupal Security Team * Heine Deelstra [10] of the Drupal Security Team [1] https://www.drupal.org/project/social [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/social/releases/12.3.8 [4] https://www.drupal.org/project/social/releases/12.4.5 [5] https://www.drupal.org/user/3545979 [6] https://www.drupal.org/user/2314038 [7] https://www.drupal.org/user/3545979 [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://www.drupal.org/user/17943

1 0

Open Social - Moderately critical - Cross Site Scripting, Denial of Service - SA-CONTRIB-2024-037
by security-news＠drupal.org 04 Sep '24

04 Sep '24

View online: https://www.drupal.org/sa-contrib-2024-037 Project: Open Social [1] Date: 2024-September-04 Security risk: *Moderately critical* 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Scripting, Denial of Service Affected versions: <12.3.8 || >=12.4.0 <12.4.5 || >=13.0.0 <13.0.0-alpha11 Description: Open Social is a Drupal distribution for online communities, which ships with an optional module called Social Embed. This module allows a website to display embedded content (such as photos or videos) when a user posts a link to that resource, without having to parse the resource directly. Added URL's were not sufficiently validated which could lead to a DoS via Blind SSRF and/or Application Takeover via Stored XSS. This vulnerability is mitigated by the fact that social_embed submodule needs to be enabled. Solution: Install the latest version: * If you use Open Social 12.3.x, upgrade to Open Social 12.3.8 [3] * If you use Open Social 12.4.x, upgrade to Open Social 12.4.5 [4] Reported By: * Thiago Régis [5] Fixed By: * Thiago Régis [6] * Ronald te Brake [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team * Juraj Nemec [9] of the Drupal Security Team [1] https://www.drupal.org/project/social [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/social/releases/12.3.8 [4] https://www.drupal.org/project/social/releases/12.4.5 [5] https://www.drupal.org/user/277221 [6] https://www.drupal.org/user/277221 [7] https://www.drupal.org/user/2314038 [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10

1 0