- Security-news - lists.drupal.org

View Password - Less critical - Cross Site Scripting - SA-CONTRIB-2024-026
by security-news＠drupal.org 31 Jul '24

31 Jul '24

View online: https://www.drupal.org/sa-contrib-2024-026 Project: View Password [1] Date: 2024-July-31 Security risk: *Less critical* 8∕25 AC:Basic/A:Admin/CI:None/II:None/E:Exploit/TD:Uncommon [2] Vulnerability: Cross Site Scripting Affected versions: <6.0.4 Description: The View Password module enables you to add a help icon button next to the password input field to toggle the password visibility. The administrative user is allowed to add classes to this icon for styling purposes. The module doesn't validate the content of classes. A malicious user with access to the View Password Settings Form could add malicious code in the classes field. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer view password". Solution: Install the latest version: * If you use the View Password module upgrade to View Password 6.0.4 [3]. Reported By: * Ide Braakman [4] Fixed By: * Ana Colautti [5] * Ide Braakman [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team * Juraj Nemec [8] of the Drupal Security Team [1] https://www.drupal.org/project/view_password [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/view_password/releases/6.0.4 [4] https://www.drupal.org/user/1879760 [5] https://www.drupal.org/user/2925043 [6] https://www.drupal.org/user/1879760 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/272316

1 0

3rd Party Libraries and Supply Chains - PSA-2024-06-26
by security-news＠drupal.org 26 Jun '24

26 Jun '24

View online: https://www.drupal.org/psa-2024-06-26 Date: 2024-June-26 Description: Following on from previous PSAs on 3rd Party code in the Drupal ecosystem: * PSA-2011-002 - External libraries and plugins [1] * Various 3rd Party Vulnerabilities - PSA-2019-09-04 | Drupal.org [2] It is the policy of the Drupal Security Team that site owners are responsible for monitoring and maintaining the security of 3rd party libraries. Supply chains are increasingly complex, and managing the associated risks is challenging. Website owners should actively manage their dependencies, potentially leveraging a Software Bill of Materials (SBOM) or scanner services. Other relevant tools include CSP [3] and SRI [4]. .... Concerns around polyfill.io The most recent case that has affected some contributed Drupal projects relates to the polyfill.io service. Recently, a new organization acquired and updated the polyfill.io service. The new service appears to be serving malicious content from the polyfill.io endpoints under specific circumstances. * https://thehackernews.com/2024/06/over-110000-websites-affected-by.html [5] * https://sansec.io/research/polyfill-supply-chain-attack [6] * https://github.com/polyfillpolyfill/polyfill-service/issues/2873 [7] In response to these concerns, several trusted providers of Javascript libraries are now also serving replacements for the polyfill.io service. Website owners should update their site to incorporate a newer, more reliable source for the polyfill.io files. * https://community.fastly.com/t/new-options-for-polyfill-io-users/2540 [8] * https://blog.cloudflare.com/polyfill-io-now-available-on-cdnjs-reduce-yo... [9] On the other hand, the polyfills may no longer be necessary in many cases, and it may be possible to remove them from sites rather than rely on a new source. Multiple Drupal projects utilize this service in various ways; several of which require code changes and new releases to switch to alternative providers. As this relates to 3rd party libraries, the Drupal Security Team will not be issuing Security Advisories for these projects and work has been done in the public issue queues [10] (note this may not be a complete list of all affected projects). There have been significant changes in the way that 3rd party code is utilized in the Drupal ecosystem since PSA-2011-002 linked to above, but the remit of the Drupal Security Team remains limited to code hosted on drupal.org’s systems. Reported By: * Heikki Ylipaavalniemi [11] * jpieper [12] * drupalam [13] Coordinated By: * Drew Webber [14] of the Drupal Security Team * Greg Knaddison [15] of the Drupal Security Team * Cathy Theys [16] of the Drupal Security Team * Juraj Nemec [17] of the Drupal Security Team * Michael Hess [18] of the Drupal Security Team [1] https://www.drupal.org/node/1189632 [2] https://www.drupal.org/psa-2019-09-04 [3] https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP [4] https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity [5] https://thehackernews.com/2024/06/over-110000-websites-affected-by.html [6] https://sansec.io/research/polyfill-supply-chain-attack [7] https://github.com/polyfillpolyfill/polyfill-service/issues/2873 [8] https://community.fastly.com/t/new-options-for-polyfill-io-users/2540 [9] https://blog.cloudflare.com/polyfill-io-now-available-on-cdnjs-reduce-your-… [10] https://www.drupal.org/project/issues/search?issue_tags=polyfill.io [11] https://www.drupal.org/user/3442607 [12] https://www.drupal.org/user/782988 [13] https://www.drupal.org/user/1076400 [14] https://www.drupal.org/user/255969 [15] https://www.drupal.org/user/36762 [16] https://www.drupal.org/user/258568 [17] https://www.drupal.org/user/272316 [18] https://www.drupal.org/user/102818

1 0

Acquia DAM - Moderately critical - Access bypass, Denial of Service - SA-CONTRIB-2024-025
by security-news＠drupal.org 05 Jun '24

05 Jun '24

View online: https://www.drupal.org/sa-contrib-2024-025 Project: Acquia DAM [1] Date: 2024-June-05 Security risk: *Moderately critical* 13∕25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass, Denial of Service Affected versions: <1.0.13 || >=1.1.0 <1.1.0-beta3 Description: Acquia DAM provides a connection to a third-party asset management system, allowing for images to be managed, linked to, and viewed from Drupal. In order for assets to be managed in Drupal, a site administrator must first authenticate the site to their DAM instance. The module doesn't sufficiently protect the ability to disconnect a site from DAM. While disconnected sites do not lose asset data in Drupal, it will prevent site editors from accessing the DAM until a site administrator re-authenticates the site. Some uncached media images may also fail to be fetched while disconnected. Solution: Install the latest version: * If you use the acquia_dam module for Drupal 9.4 or above, upgrade to Acquia DAM 1.0.13 [3]. * If you use a pre-release version of acquia_dam 1.1, upgrade to Acquia DAM 1.1.0-beta3 [4]. (Note: beta releases generally do not receive security coverage.) Reported By: * Matt Glaman [5] Fixed By: * Matt Glaman [6] * Greg Knaddison [7] of the Drupal Security Team * Balázs Ertl-Bakos [8] * Jakob Perry [9] Coordinated By: * Greg Knaddison [10] of the Drupal Security Team * xjm [11] of the Drupal Security Team [1] https://www.drupal.org/project/acquia_dam [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/acquia_dam/releases/1.0.13 [4] https://www.drupal.org/project/acquia_dam/releases/1.1.0-beta3 [5] https://www.drupal.org/user/2416470 [6] https://www.drupal.org/user/2416470 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/1086292 [9] https://www.drupal.org/user/45640 [10] https://www.drupal.org/user/36762 [11] https://www.drupal.org/user/65776

1 0

Drupal REST & JSON API Authentication - Moderately critical - Access bypass - SA-CONTRIB-2024-022
by security-news＠drupal.org 29 May '24

29 May '24

View online: https://www.drupal.org/sa-contrib-2024-022 Project: Drupal REST & JSON API Authentication [1] Date: 2024-May-29 Security risk: *Moderately critical* 11∕25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <2.0.13 Description: Drupal REST & JSON API Authentication module restricts and secures unauthorized access to your Drupal site APIs using different authentication methods including Basic Authentication , API Key Authentication , JWT Authentication , OAuth Authentication , External / Third-Party Provider Authentication, etc. The module doesn't sufficiently control user access when using Basic Authentication. Solution: Install the latest version: * If you use the 2.0.x branch, upgrade to Drupal REST & JSON API Authentication 2.0.13 [3] * If you use the 8.x-1.x branch, upgrade to Drupal REST & JSON API Authentication 2.0.13 [4], as the 8.x-1.x branch is now unsupported. Reported By: * Arek Suchecki [5] Fixed By: * solideogloria [6] * Shashank Thigale [7] * Arek Suchecki [8] * Greg Knaddison [9] of the Drupal Security Team Coordinated By: * Greg Knaddison [10] of the Drupal Security Team * Juraj Nemec [11] of the Drupal Security Team * David Rothstein [12] of the Drupal Security Team [1] https://www.drupal.org/project/rest_api_authentication [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/rest_api_authentication/releases/2.0.13 [4] https://www.drupal.org/project/rest_api_authentication/releases/2.0.13 [5] https://www.drupal.org/user/3553379 [6] https://www.drupal.org/user/3589277 [7] https://www.drupal.org/user/3632808 [8] https://www.drupal.org/user/3553379 [9] https://www.drupal.org/user/36762 [10] https://www.drupal.org/user/36762 [11] https://www.drupal.org/user/272316 [12] https://www.drupal.org/user/124982

1 0

Image Sizes - Moderately critical - Access bypass - SA-CONTRIB-2024-023
by security-news＠drupal.org 29 May '24

29 May '24

View online: https://www.drupal.org/sa-contrib-2024-023 Project: Image Sizes [1] Date: 2024-May-29 Security risk: *Moderately critical* 14∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <3.0.2 Description: This module enables you to create responsive image styles that depend on the parent element's width. The module doesn't sufficiently check access to rendered images, resulting in access bypass vulnerabilities in specific scenarios. Solution: Install the latest version. * If you use the Image Sizes module for Drupal 10, upgrade to Image Sizes 3.0.2 [3] Reported By: * Dezső Biczó [4] Fixed By: * Dezső Biczó [5] * Pascal Crott [6] * Juraj Nemec [7] of the Drupal Security Team Coordinated By: * Juraj Nemec [8] of the Drupal Security Team * Neil Drumm [9] of the Drupal Security Team [1] https://www.drupal.org/project/image_sizes [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/image_sizes/releases/3.0.2 [4] https://www.drupal.org/user/315522 [5] https://www.drupal.org/user/315522 [6] https://www.drupal.org/user/647364 [7] https://www.drupal.org/user/272316 [8] https://www.drupal.org/user/272316 [9] https://www.drupal.org/user/3064

1 0

Migrate queue importer - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-024
by security-news＠drupal.org 29 May '24

29 May '24

View online: https://www.drupal.org/sa-contrib-2024-024 Project: Migrate queue importer [1] Date: 2024-May-29 Security risk: *Moderately critical* 10∕25 AC:Basic/A:Admin/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Request Forgery Affected versions: <2.1.1 Description: The Migrate queue importer module enables you to create cron migrations(configuration entities) with a reference towards migration entities in order to import them during cron runs. The module doesn't sufficiently protect against Cross Site Request Forgery under specific scenarios allowing an attacker to enable/disable a cron migration. This vulnerability is mitigated by the fact that an attacker must know the id of the migration. Solution: Install the latest version: * If you use Migrate queue importer module for Drupal 10, upgrade to Migrate queue importer 2.1.1 [3] Reported By: * Pierre Rudloff [4] Fixed By: * David Bätge [5] * Pierre Rudloff [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team * Juraj Nemec [8] of the Drupal Security Team [1] https://www.drupal.org/project/migrate_queue_importer [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/migrate_queue_importer/releases/2.1.1 [4] https://www.drupal.org/user/3611858 [5] https://www.drupal.org/user/2526160 [6] https://www.drupal.org/user/3611858 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/272316

1 0

Commerce View Receipt - Moderately critical - Access bypass - SA-CONTRIB-2024-021
by security-news＠drupal.org 22 May '24

22 May '24

View online: https://www.drupal.org/sa-contrib-2024-021 Project: Commerce View Receipt [1] Date: 2024-May-22 Security risk: *Moderately critical* 13∕25 AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <1.0.3 Description: The Commerce View Receipts module enables you to view commerce order receipts in the browser. The module doesn't sufficiently check access permissions, allowing a malicious to view the private information of other customers. Solution: Install the latest version. * If you use the Commerce View Receipts module for Drupal, upgrade to Commerce View Receipts 1.0.3 [3]. Sites may wish to temporarily revoke the "view receipts" permission from most roles until the site can be upgraded to the latest version. Reported By: * Norman Kämper-Leymann [4] Fixed By: * Norman Kämper-Leymann [5] * Greg Mack [6] * Greg Knaddison [7] of the Drupal Security Team * Drew Webber [8] of the Drupal Security Team Coordinated By: * Greg Knaddison [9] of the Drupal Security Team * Juraj Nemec [10] of the Drupal Security Team * xjm [11] of the Drupal Security Team [1] https://www.drupal.org/project/commerce_view_receipt [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/commerce_view_receipt/releases/1.0.3 [4] https://www.drupal.org/user/2482808 [5] https://www.drupal.org/user/2482808 [6] https://www.drupal.org/user/336930 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/255969 [9] https://www.drupal.org/user/36762 [10] https://www.drupal.org/u/poker10 [11] https://www.drupal.org/u/xjm

1 0

Email Contact - Moderately critical - Access bypass - SA-CONTRIB-2024-020
by security-news＠drupal.org 22 May '24

22 May '24

View online: https://www.drupal.org/sa-contrib-2024-020 Project: Email Contact [1] Date: 2024-May-22 Security risk: *Moderately critical* 12∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <2.0.4 Description: The Email Contact module provides email field display formatters that can display the field as a link to the contact form, or as an inline contact form. The module does not sufficiently handle restricted entity or field access to the mail sending form, when the "Email contact link" formatter is used. This vulnerability is mitigated by the fact that it requires the "Email contact link" formatter to be used. Solution: Install the latest version: * If you use the 2.0.x branch, upgrade to email_contact 2.0.4 [3]. * If you use the 8.x-1.x branch, upgrade to email_contact 2.0.4 [4], as the 8.x-1.x branch is now unsupported. Reported By: * Claudiu Cristea [5] Fixed By: * Claudiu Cristea [6] * Bálint Nagy [7] * Greg Knaddison [8] of the Drupal Security Team * Juraj Nemec [9] of the Drupal Security Team * xjm [10] of the Drupal Security Team Coordinated By: * Greg Knaddison [11] of the Drupal Security Team * xjm [12] of the Drupal Security Team * Juraj Nemec [13] of the Drupal Security Team [1] https://www.drupal.org/project/email_contact [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/email_contact/releases/2.0.4 [4] https://www.drupal.org/project/email_contact/releases/2.0.4 [5] https://www.drupal.org/user/56348 [6] https://www.drupal.org/user/56348 [7] https://www.drupal.org/user/1763952 [8] https://www.drupal.org/user/36762 [9] https://www.drupal.org/user/272316 [10] https://www.drupal.org/user/65776 [11] https://www.drupal.org/u/greggles [12] https://www.drupal.org/u/xjm [13] https://www.drupal.org/user/272316

1 0

RESTful Web Services - Critical - Access bypass - SA-CONTRIB-2024-019
by security-news＠drupal.org 15 May '24

15 May '24

View online: https://www.drupal.org/sa-contrib-2024-019 Project: RESTful Web Services [1] Date: 2024-May-15 Security risk: *Critical* 16∕25 AC:None/A:None/CI:Some/II:None/E:Proof/TD:All [2] Vulnerability: Access bypass Description: This module exposes Drupal resources (e.g. entities) as RESTful web services. The module doesn't sufficiently restrict access for user resources. Solution: Install the latest version: * If you use the RESTful Web Services module for Drupal 7, upgrade to RESTful Web Services 7.x-2.10 [3] Reported By: * Fran Garcia-Linares [4] Fixed By: * Neil Drumm [5] of the Drupal Security Team * Fran Garcia-Linares [6] Coordinated By: * Neil Drumm [7] of the Drupal Security Team [1] https://www.drupal.org/project/restws [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/restws/releases/7.x-2.10 [4] https://www.drupal.org/user/2495842 [5] https://www.drupal.org/user/3064 [6] https://www.drupal.org/user/2495842 [7] https://www.drupal.org/user/3064

1 0

REST Views - Moderately critical - Information Disclosure - SA-CONTRIB-2024-018
by security-news＠drupal.org 24 Apr '24

24 Apr '24

View online: https://www.drupal.org/sa-contrib-2024-018 Project: REST Views [1] Date: 2024-April-24 Security risk: *Moderately critical* 14∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Information Disclosure Affected versions: <3.0.1 Description: The Rest views module lets site admins create rest exports in views with additional options for serializing data. This module does not accurately check access and may expose paths to unpublished content. This vulnerability is mitigated by the fact that there must be a specific content structure to expose. Paths to unpublished entities (such as nodes) will be exposed if those entities are referenced from other entities listed in a REST display, and the reference field on those listed entities is displayed with the "Entity path" formatter. Solution: Install the latest version: * REST Views 8.x-1.x versions are unsupported. * REST Views 2.x versions upgrade to Rest Views 3.0.1 [3] * REST Views 3.x versions prior to 3.0.1 upgrade to Rest Views 3.0.1 [4] Reported By: * nicxvan [5] Fixed By: * nicxvan [6] Coordinated By: * Benji Fisher [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team * Cathy Theys [9] of the Drupal Security Team [1] https://www.drupal.org/project/rest_views [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/rest_views/releases/3.0.1 [4] https://www.drupal.org/project/rest_views/releases/3.0.1 [5] https://www.drupal.org/user/531480 [6] https://www.drupal.org/user/531480 [7] https://www.drupal.org/user/683300 [8] https://www.drupal.org/user/36762 [9] https://www.drupal.org/user/258568

1 0