- Security-news - lists.drupal.org

Advanced PWA - Critical - Access bypass - SA-CONTRIB-2024-017
by security-news＠drupal.org 24 Apr '24

24 Apr '24

View online: https://www.drupal.org/sa-contrib-2024-017 Project: Advanced PWA [1] Date: 2024-April-24 Security risk: *Critical* 16∕25 AC:None/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <1.5.0 Description: Progressive web applications are web applications that load like regular web pages or websites but can offer the user functionality such as working offline, push notifications, and device hardware access traditionally available only to native applications. This module doesn't sufficiently protect access to the settings form, allowing an unauthorized malicious user to view and modify the module settings. Solution: Install the latest version: * If you use the Advanced Progressive Web App module for Drupal 8.x, upgrade to Advanced Progressive Web App 8.x-1.5 [3] Reported By: * Matthew Grasmick [4] Fixed By: * gMaximus [5] Coordinated By: * Greg Knaddison [6] of the Drupal Security Team * Michael Hess [7] of the Drupal Security Team * cilefen [8] of the Drupal Security Team * Cathy Theys [9] of the Drupal Security Team [1] https://www.drupal.org/project/advanced_pwa [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/advanced_pwa/releases/8.x-1.5 [4] https://www.drupal.org/user/455714 [5] https://www.drupal.org/user/1612496 [6] https://www.drupal.org/user/36762 [7] https://www.drupal.org/user/102818 [8] https://www.drupal.org/user/1850070 [9] https://www.drupal.org/user/258568

1 0

TacJS - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-016
by security-news＠drupal.org 27 Mar '24

27 Mar '24

View online: https://www.drupal.org/sa-contrib-2024-016 Project: TacJS [1] Date: 2024-March-27 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Affected versions: <6.5.0 Description: This module enables sites to comply with the European cookie law using tarteaucitron.js. The module doesn't sufficiently filter user-supplied markup inside of content leading to a persistent Cross Site Scripting (XSS) vulnerability. More details are available in CVE-2023-3620 [3]. This vulnerability is mitigated by the fact that an attacker needs to be able to write content in the page, a feature commonly available on Drupal sites. Solution: Install the latest version: * If you use the tacjs module for Drupal 8.x, upgrade to tacjs 8.x-6.5 [4] Reported By: * Pierre Rudloff [5] Fixed By: * Frank Mably [6] * Pierre Rudloff [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/tacjs [2] https://www.drupal.org/security-team/risk-levels [3] https://nvd.nist.gov/vuln/detail/CVE-2023-3620 [4] https://www.drupal.org/project/tacjs/releases/8.x-6.5 [5] https://www.drupal.org/user/3611858 [6] https://www.drupal.org/user/3375160 [7] https://www.drupal.org/user/3611858 [8] https://www.drupal.org/user/36762

1 0

Registration role - Critical - Access bypass - SA-CONTRIB-2024-015
by security-news＠drupal.org 06 Mar '24

06 Mar '24

View online: https://www.drupal.org/sa-contrib-2024-015 Project: Registration role [1] Date: 2024-March-06 Security risk: *Critical* 18∕25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <2.0.1 Description: The Registration role module lets an administrator select a role (or multiple roles) to automatically assign to new users. The selected role (or roles) will be assigned to new registrants. The module has a logic error when handling sites that upgraded code and did not run the Drupal update process (e.g. update.php). This vulnerability is mitigated by the fact that the problem does not exist on sites that followed the process of updating code and running the standard updates. Solution: Install the latest version: * If you use the Registration role module version 2.x, upgrade to Registration role 2.0.1 [3] Review user accounts registered between 2023 July 11 and now for having additional roles you did not intend for them to have. If your site missed or reverted an update to configuration in the version 2.0.0 release of Registration Role (or development branch from 2020 August 17 on), non-selected roles were not removed from configuration. Without this update, up until you re-saved the settings form or until you install the new release - whichever came first - users who registered receive /all/ roles. Also, upgrade to the latest version /and run update hooks/ at update.php or with Drush, drush updb OR: Immediately re-save the the configuration page at /admin/people/registration-role Reported By: * Pamela Barone [4] * Renaud Joubert [5] Fixed By: * Juraj Nemec [6] of the Drupal Security Team * Benjamin Melançon [7] Coordinated By: * Juraj Nemec [8] of the Drupal Security Team * Greg Knaddison [9] of the Drupal Security Team * Drew Webber [10] of the Drupal Security Team [1] https://www.drupal.org/project/registration_role [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/registration_role/releases/2.0.1 [4] https://www.drupal.org/user/1431110 [5] https://www.drupal.org/user/549974 [6] https://www.drupal.org/user/272316 [7] https://www.drupal.org/user/64383 [8] https://www.drupal.org/user/272316 [9] https://www.drupal.org/user/36762 [10] https://www.drupal.org/user/255969

1 0

Drupal Symfony Mailer Lite - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-014
by security-news＠drupal.org 28 Feb '24

28 Feb '24

View online: https://www.drupal.org/sa-contrib-2024-014 Project: Drupal Symfony Mailer Lite [1] Date: 2024-February-28 Security risk: *Moderately critical* 12∕25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Request Forgery Affected versions: <1.0.6 Description: The module doesn’t sufficiently protect against malicious links, which means an attacker can trick an administrator into performing unwanted actions. This vulnerability is mitigated by the fact that the set of unwanted actions is limited to specific configurations. Solution: Upgrade to Symfony Mailer Lite 1.0.6 [3] and rebuild Drupal's cache. Reported By: * Mingsong [4] Fixed By: * Lee Rowlands [5] of the Drupal Security Team * Wayne Eaker [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team * Juraj Nemec [8] of the Drupal Security Team * Lee Rowlands [9] of the Drupal Security Team [1] https://www.drupal.org/project/symfony_mailer_lite [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/symfony_mailer_lite/releases/1.0.6 [4] https://www.drupal.org/user/2986445 [5] https://www.drupal.org/user/395439 [6] https://www.drupal.org/user/326925 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/272316 [9] https://www.drupal.org/user/395439

1 0

Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-013
by security-news＠drupal.org 28 Feb '24

28 Feb '24

View online: https://www.drupal.org/sa-contrib-2024-013 Project: Node Access Rebuild Progressive [1] Date: 2024-February-28 Security risk: *Less critical* 9∕25 AC:Complex/A:Admin/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: This module provides an alternative mean of rebuilding the Content Access table. The module doesn't sufficiently reset the state of content access when the module is uninstalled. Solution: Install the latest version: * If you use the node_access_rebuild_progressive module for Drupal 7, upgrade to node_access_rebuild_progressive 7.x-1.2 [3] Reported By: * Jen Lampton [4] Provisional Member of the Drupal Security Team Fixed By: * Shelane French [5] * Juraj Nemec [6] of the Drupal Security Team * Jen Lampton [7] Provisional Member of the Drupal Security Team Coordinated By: * Greg Knaddison [8] of the Drupal Security Team * Juraj Nemec [9] of the Drupal Security Team [1] https://www.drupal.org/project/node_access_rebuild_progressive [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/node_access_rebuild_progressive/releases/7.x… [4] https://www.drupal.org/user/85586 [5] https://www.drupal.org/user/2674989 [6] https://www.drupal.org/user/272316 [7] https://www.drupal.org/user/85586 [8] https://www.drupal.org/user/36762 [9] https://www.drupal.org/user/272316

1 0

Private content - Moderately critical - Access bypass - SA-CONTRIB-2024-012
by security-news＠drupal.org 28 Feb '24

28 Feb '24

View online: https://www.drupal.org/sa-contrib-2024-012 Project: Private content [1] Date: 2024-February-28 Security risk: *Moderately critical* 12∕25 AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: <2.1.0 Description: This module gives each node a 'private' checkbox. If it's set, the node can only be seen by the node author, or users with the 'access private content' permission. The module incorrectly grants access to private nodes under certain specific circumstances. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Access private content". Solution: Install the latest version: * If you use the Private Content module for Drupal 8.x, upgrade to Private Content 8.x-2.1 [3] Reported By: * kiwimind [4] Fixed By: * Adam Shepherd [5] Coordinated By: * Greg Knaddison [6] of the Drupal Security Team * Juraj Nemec [7] of the Drupal Security Team [1] https://www.drupal.org/project/private_content [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/private_content/releases/8.x-2.1 [4] https://www.drupal.org/user/749470 [5] https://www.drupal.org/user/2650563 [6] https://www.drupal.org/user/36762 [7] https://www.drupal.org/user/272316

1 0

Coffee - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-011
by security-news＠drupal.org 28 Feb '24

28 Feb '24

View online: https://www.drupal.org/sa-contrib-2024-011 Project: Coffee [1] Date: 2024-February-28 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Affected versions: <1.4.0 Description: The Coffee module helps you to navigate through the Drupal admin menus faster with a shortcut popup. The module doesn't sufficiently escape menu names when displaying them in the popup, thereby exposing a XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer menus and menu links". Solution: Install the latest version: * If you use the Coffee module for Drupal 10, upgrade to Coffee 8.x-1.4 [3] Reported By: * Patrick Fey [4] Fixed By: * Michael Mol [5] * Klaus Purer [6] * Oliver Köhler [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/coffee [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/coffee/releases/8.x-1.4 [4] https://www.drupal.org/user/998680 [5] https://www.drupal.org/user/919186 [6] https://www.drupal.org/user/262198 [7] https://www.drupal.org/user/1781874 [8] https://www.drupal.org/user/36762

1 0

Node Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-010
by security-news＠drupal.org 21 Feb '24

21 Feb '24

View online: https://www.drupal.org/sa-contrib-2024-010 Project: Node Access Rebuild Progressive [1] Date: 2024-February-21 Security risk: *Less critical* 9∕25 AC:Complex/A:Admin/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <2.0.2 Description: This module provides an alternative mean of rebuilding the Content Access table. The module doesn't sufficiently reset the state of content access when the module is uninstalled. Solution: Install the latest version: * If you use the node_access_rebuild_progressive module for Drupal 9.4+, upgrade to node_access_rebuild_progressive 2.0.2 [3] Reported By: * Pierre Rudloff [4] Fixed By: * Pierre Rudloff [5] * Shelane French [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team * Damien McKenna [8] of the Drupal Security Team [1] https://www.drupal.org/project/node_access_rebuild_progressive [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/node_access_rebuild_progressive/releases/2.0… [4] https://www.drupal.org/user/3611858 [5] https://www.drupal.org/user/3611858 [6] https://www.drupal.org/user/2674989 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/108450

1 0

CKEditor 4 LTS - WYSIWYG HTML editor - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-009
by security-news＠drupal.org 14 Feb '24

14 Feb '24

View online: https://www.drupal.org/sa-contrib-2024-009 Project: CKEditor 4 LTS - WYSIWYG HTML editor [1] Date: 2024-February-14 Security risk: *Moderately critical* 12∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross Site Scripting Affected versions: >=1.0.0 <1.0.1 Description: The CKEditor 4 LTS - WYSIWYG HTML editor module uses the CKEditor library for WYSIWYG editing. CKEditor has released a security update [3] that on certain configurations may impact the Drupal module that bundles and integrates this code. The vulnerability is mitigated by the fact it requires: 1) full-page editing [4] mode is enabled 2) or CDATA elements in Advanced Content Filtering configuration (defaults to script and style elements) are enabled. 3) An attacker must have a permission with access to the CKEditor instance. For more information, see CKEditor's security advisory: CVE-2024-24815 [5]: Cross-site scripting (XSS) vulnerability caused by incorrect CDATA detection Solution: Install the latest version: * If you use the CKEditor 4 LTS - WYSIWYG HTML editor module for Drupal 9.4+, upgrade to ckeditor_lts 1.0.1 [6] Reported By: * cilefen [7] of the Drupal Security Team * Juraj Nemec [8] of the Drupal Security Team Fixed By: * Wojciech Kukowski [9] * Jacek Bogdański [10] * Dawid [11] Coordinated By: * Greg Knaddison [12] of the Drupal Security Team * catch [13] of the Drupal Security Team [1] https://www.drupal.org/project/ckeditor_lts [2] https://www.drupal.org/security-team/risk-levels [3] https://ckeditor.com/cke4/release/CKEditor-4.24.0-LTS [4] https://ckeditor.com/docs/ckeditor4/latest/features/fullpage.html [5] https://github.com/ckeditor/ckeditor4/security/advisories/GHSA-fq6h-4g8v-qq… [6] https://www.drupal.org/project/ckeditor_lts/releases/1.0.1 [7] https://www.drupal.org/user/1850070 [8] https://www.drupal.org/user/272316 [9] https://www.drupal.org/user/3104645 [10] https://www.drupal.org/user/3683355 [11] https://www.drupal.org/user/3741013 [12] https://www.drupal.org/user/36762 [13] https://www.drupal.org/user/35733

1 0

Migrate Tools - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-008
by security-news＠drupal.org 07 Feb '24

07 Feb '24

View online: https://www.drupal.org/sa-contrib-2024-008 Project: Migrate Tools [1] Date: 2024-February-07 Security risk: *Moderately critical* 12∕25 AC:Complex/A:None/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Request Forgery Affected versions: <6.0.3 Description: The Migrate Tools module provides tools for running and managing Drupal migrations. The module doesn't sufficiently protect against Cross Site Request Forgery under specific scenarios allowing an attacker to initiate a migration. This vulnerability is mitigated by the fact that an attacker must know the name of the migration. Solution: Install the latest version: * If you use the Migrate Tools module for Drupal 10, upgrade to Migrate Tools 6.0.3 [3] Reported By: * Andreas Hennings [4] Fixed By: * Andreas Hennings [5] * Lucas Hedding [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team [1] https://www.drupal.org/project/migrate_tools [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/migrate_tools/releases/6.0.3 [4] https://www.drupal.org/user/459338 [5] https://www.drupal.org/user/459338 [6] https://www.drupal.org/user/1463982 [7] https://www.drupal.org/user/36762

1 0