- Security-news - lists.drupal.org

Libraries UI - Moderately critical - Access bypass - SA-CONTRIB-2023-027
by security-news＠drupal.org 28 Jun '23

28 Jun '23

View online: https://www.drupal.org/sa-contrib-2023-027 Project: Libraries UI [1] Version: 8.x-1.0 Date: 2023-June-28 Security risk: *Moderately critical* 11∕25 AC:None/A:None/CI:None/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Description: This module enables a UI to display all libraries provided by modules and themes on the Drupal site. The module doesn't sufficiently protect the libraries reporting page. It curently is using the 'access content' permission and not a proper administrative/access permission. The vulnerability/library information can be exploited by simply visiting/knowing the url of the reporting page. The solution is to protect the page via a module specific permission that must be granted by an administrative user. Solution: Install the latest version of 8.x-1.x or upgrade to 8.x-2.x: * If you use the Libraries UI module 8.x-1.0, upgrade to Libraries UI 8.x-1.1 [3] * The vulnerability does not affect the Libraries UI module 8.x-2.x series. Reported By: * Jörg Riemenschneider [4] Fixed By: * Jörg Riemenschneider [5] * George [6] Coordinated By: * Damien McKenna [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/libraries_ui [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/libraries_ui/releases/8.x-1.1 [4] https://www.drupal.org/user/2809357 [5] https://www.drupal.org/user/2809357 [6] https://www.drupal.org/user/1270728 [7] https://www.drupal.org/user/108450 [8] https://www.drupal.org/user/36762

1 0

Search Autocomplete - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-026
by security-news＠drupal.org 28 Jun '23

28 Jun '23

View online: https://www.drupal.org/sa-contrib-2023-026 Project: Search Autocomplete [1] Date: 2023-June-28 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Affected versions: >=2.0.0 <2.0.3 Description: This module enables you to use complex autocompletion in forms. The module doesn't sufficiently filter text in the data it exposes, allowing a malicious user to enter specially crafted tags to exploit a Cross Site Scripting (XSS) attack. This vulnerability is mitigated by the fact that an attacker must have a role which allows them to publish the kind of data used in the autocomplete (for instance create nodes if the tool is used to search nodes, comments if the tool is used to search comments, etc...) Solution: Install the latest version: * If you use the search_autocomplete module for Drupal 8.x or 9.x, upgrade to Search Autocomplete 2.0.3 [3] Reported By: * Mingsong [4] Fixed By: * Mingsong [5] * Dominique CLAUSE [6] * Greg Knaddison [7] of the Drupal Security Team * Drew Webber [8] of the Drupal Security Team Coordinated By: * Damien McKenna [9] of the Drupal Security Team * Drew Webber [10] of the Drupal Security Team * Greg Knaddison [11] of the Drupal Security Team [1] https://www.drupal.org/project/search_autocomplete [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/search_autocomplete/releases/2.0.3 [4] https://www.drupal.org/user/2986445 [5] https://www.drupal.org/user/2986445 [6] https://www.drupal.org/user/801982 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/255969 [9] https://www.drupal.org/user/108450 [10] https://www.drupal.org/user/255969 [11] https://www.drupal.org/user/36762

1 0

Mailchimp - Critical - Cross Site Request Forgery - SA-CONTRIB-2023-025
by security-news＠drupal.org 28 Jun '23

28 Jun '23

View online: https://www.drupal.org/sa-contrib-2023-025 Project: Mailchimp [1] Date: 2023-June-28 Security risk: *Critical* 15∕25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Request Forgery Affected versions: >=2.2.0 <2.2.2 Description: This module provides integration with Mailchimp, a popular email delivery service. A route related to OAuth authentication is not protected against a Cross Site Request Forgery attack. Solution: Install the latest version: * If you use the mailchimp module for Drupal 8.x, upgrade to mailchimp 2.2.2 [3] Reported By: * Heine [4] of the Drupal Security Team Fixed By: * Olivier Bouwman [5] * Andy Price [6] * Maria Fisher [7] Coordinated By: * Heine [8] of the Drupal Security Team * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/mailchimp [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/mailchimp/releases/2.2.2 [4] https://www.drupal.org/user/17943 [5] https://www.drupal.org/user/2799483 [6] https://www.drupal.org/user/369147 [7] https://www.drupal.org/user/2210776 [8] https://www.drupal.org/user/17943 [9] https://www.drupal.org/user/36762

1 0

GridStack - Less critical - Cross Site Scripting - SA-CONTRIB-2023-024
by security-news＠drupal.org 28 Jun '23

28 Jun '23

View online: https://www.drupal.org/sa-contrib-2023-024 Project: GridStack [1] Version: 8.x-2.108.x-2.98.x-2.88.x-2.78.x-2.68.x-2.58.x-2.48.x-2.38.x-2.28.x-2.18.x-2.0 Date: 2023-June-28 Security risk: *Less critical* 7∕25 AC:Complex/A:Admin/CI:None/II:None/E:Exploit/TD:Uncommon [2] Vulnerability: Cross Site Scripting Description: This module enables you to create dynamic layouts and add sample color palettes for color selection hints via its UI. The module doesn't sufficiently sanitize the module's settings in certain scenarios leading to a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permissions "administer gridstack". Solution: Install the latest version: * If you use the GridStack module prior to version 8.x-2.11 for Drupal 9.x or 10.x, upgrade to GridStack 8.x-2.11 [3] Reported By: * Mitch Portier [4] Fixed By: * Gaus Surahman [5] * Mitch Portier [6] Coordinated By: * Damien McKenna [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/gridstack [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/gridstack/releases/8.x-2.11 [4] https://www.drupal.org/user/2284182 [5] https://www.drupal.org/user/159062 [6] https://www.drupal.org/user/2284182 [7] https://www.drupal.org/user/108450 [8] https://www.drupal.org/user/36762

1 0

GDPR Alert - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-023
by security-news＠drupal.org 28 Jun '23

28 Jun '23

View online: https://www.drupal.org/sa-contrib-2023-023 Project: GDPR Alert [1] Version: 1.0.0 Date: 2023-June-28 Security risk: *Moderately critical* 11∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross Site Scripting Affected versions: >=1.0 <1.0.1 Description: This module enables you to define configurable GDPR alert messages. The module doesn't sufficiently filter user-supplied text leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker needs additional permissions. The vulnerability can be exploited by an attacker with a role with the permission "administer gdpr alert" regardless of other configurations. Solution: Install the latest version: * If you use the GDPR alert module 1.0.0, upgrade to GDPR alert 1.0.1 [3] Reported By: * Mitch Portier [4] Fixed By: * George [5] * Mitch Portier [6] Coordinated By: * Damien McKenna [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/gdpr_alert [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/gdpr_alert/releases/1.0.1 [4] https://www.drupal.org/user/2284182 [5] https://www.drupal.org/user/1270728 [6] https://www.drupal.org/user/2284182 [7] https://www.drupal.org/user/108450 [8] https://www.drupal.org/user/36762

1 0

Civic Cookie Control - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-021
by security-news＠drupal.org 21 Jun '23

21 Jun '23

View online: https://www.drupal.org/sa-contrib-2023-021 Project: Civic Cookie Control [1] Date: 2023-June-21 Security risk: *Moderately critical* 11∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross Site Scripting Description: CivicCookieControl is a module that can help make a website compliant with EU and UK cookie legislation. The Civic GovUK Cookie Control module does not sufficiently sanitize the configuration resulting in a Cross-Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that the attacker must have a role with the "Administer Civic Cookie Control" permission. Solution: Install the latest version: * If you use the Civic Cookie Control module for Drupal 9.x, upgrade to Civic Cookie Control 4.4.13 [3] Reported By: * Mitch Portier [4] Fixed By: * Thanassis Perperis [5] * Mitch Portier [6] Coordinated By: * Damien McKenna [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/civicccookiecontrol [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/civicccookiecontrol/releases/4.4.13 [4] https://www.drupal.org/user/2284182 [5] https://www.drupal.org/user/2701781 [6] https://www.drupal.org/user/2284182 [7] https://www.drupal.org/user/108450 [8] https://www.drupal.org/user/36762

1 0

Album Photos - Critical - Access bypass - SA-CONTRIB-2023-022
by security-news＠drupal.org 21 Jun '23

21 Jun '23

View online: https://www.drupal.org/sa-contrib-2023-022 Project: Album Photos [1] Date: 2023-June-21 Security risk: *Critical* 15∕25 AC:None/A:Admin/CI:All/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Description: This module enables you to create and manage photos and photo albums on your website. The module doesn't sufficiently check node access when a user is provided the "edit any photo" or "delete any photo" permissions. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "edit any photo" or "delete any photo". Solution: Install the latest version: * If you use the 6.0.x version of the photos module for Drupal 9 or 10, upgrade to photos 6.0.4 [3] * If you use the 8.x version of the photos module for Drupal 9, upgrade to photos 8.x-4.5 [4] Reported By: * Marco Bouwer [5] Fixed By: * Nathaniel Burnett [6] * Marco Bouwer [7] Coordinated By: * Chris McCafferty [8] of the Drupal Security Team * Damien McKenna [9] of the Drupal Security Team * Greg Knaddison [10] of the Drupal Security Team [1] https://www.drupal.org/project/photos [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/photos/releases/6.0.4 [4] https://www.drupal.org/project/photos/releases/8.x-4.5 [5] https://www.drupal.org/user/1443348 [6] https://www.drupal.org/user/443482 [7] https://www.drupal.org/user/1443348 [8] https://www.drupal.org/user/1850070 [9] https://www.drupal.org/user/108450 [10] https://www.drupal.org/user/36762

1 0

Office Hours - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-020
by security-news＠drupal.org 14 Jun '23

14 Jun '23

View online: https://www.drupal.org/sa-contrib-2023-020 Project: Office Hours [1] Version: 8.x-1.58.x-1.48.x-1.38.x-1.28.x-1.18.x-1.0 Date: 2023-June-14 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: This module enables you to define a 'weekly office hours' field type, and add a field to any Content type, in order to display the weekly opening hours for a location. The module doesn't sufficiently filter user-supplied text leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker needs additional permissions. The vulnerability can be exploited by an attacker with a role with the permission "administer display" regardless of other configurations. In some scenarios, the vulnerability can be exploited by a user with "Create content" or "Edit content" for a relevant Content type. Solution: Install the latest version: * If you use the 'Office hours' module for Drupal 8.x, upgrade to office_hours 8.x-1.11 [3] Reported By: * John Voskuilen [4] * Mitch Portier [5] Fixed By: * John Voskuilen [6] * Mitch Portier [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/office_hours [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/office_hours/releases/8.x-1.11 [4] https://www.drupal.org/user/591042 [5] https://www.drupal.org/user/2284182 [6] https://www.drupal.org/user/591042 [7] https://www.drupal.org/user/2284182 [8] https://www.drupal.org/user/36762

1 0

End of life announcement and changes to Drupal 7 support - PSA-2023-06-07
by security-news＠drupal.org 07 Jun '23

07 Jun '23

View online: https://www.drupal.org/psa-2023-06-07 Date: 2023-June-07 Description: -------- DRUPAL 7'S END OF LIFE IS JANUARY 5, 2025 --------------------------- On February 23, 2022, we announced that we would be extending the End-of-Life for Drupal 7 until at least November 1, 2023. Today, we are officially announcing that Drupal 7 will reach its end of life on January 5, 2025. With this final extension, the Drupal Security Team is also adjusting the level of support provided. *This will be the final extension.* .... Reduced support for moderately critical Drupal 7 issues Effective August 1, 2023, the Drupal Security Team may choose to publicly post moderately critical and less critical issues affecting Drupal 7 in the public issue queue for resolution, as long as they are not mass-exploitable. (Security risk levels defined [1].) Drupal 9 and above are not affected by this change. When a security issue affects both Drupal 7 and Drupal 10, for example, the Drupal 10 security advisory may be released without a corresponding Drupal 7 fix, and the Drupal 7 issue made public at that point. .... Drupal 7 branches of unsupported modules are no longer eligible for new maintainership Community support for contributed modules will continue as it has to date. However, beginning August 1, 2023, once the Drupal 7 branch of a contributed module is marked unsupported it will not be eligible for new maintainership and will not be marked supported again. This will be true if an existing maintainer marks the module unsupported, or if the security team marks it unsupported for lack of response. If there are Drupal 7 modules that you or your clients rely on, then *we strongly encourage you to adopt these modules [2] proactively.* The Drupal security team will not issue security advisories for any unsupported libraries that Drupal 7 contributed modules rely on, such as CKEditor 4. .... PHP 5.5 and below will no longer be supported on Drupal 7 Effective August 1, 2023, we will no longer support PHP versions lower than 5.6 for Drupal 7. We may issue further PSAs increasing the minimum PHP requirement any time before Drupal 7's end of life. .... Security fixes will no longer be provided for Drupal 7 Windows-only issues Effective August 1, 2023, we will no longer provide Drupal 7 security fixes for Windows-only issues. If you are running a Drupal 7 site on Windows, you should look into migrating to another operating system for hosting your site. .... Drupal.org will no longer package Drupal 7 distributions Effective August 1, 2023, Drupal.org will no longer create Drupal 7 distribution packages with Drush make files. If you need a distribution built, you can use drush make locally. -------- THIS IS THE FINAL EXTENSION OF DRUPAL 7 COMMUNITY SUPPORT ----------- Current support is made possible thanks to the Drupal core maintainers, the Drupal Security Team, and organizations and volunteers who contribute to Drupal 7 issues. You can donate to support the work of the Drupal Security Team on our Security Team Donations [3] page. To learn more about sponsoring Drupal core maintainers and contributors, read xjm's blog post: Why sponsor a core committer? [4] -------- WHAT THE DRUPAL 7 END OF LIFE MEANS FOR YOU ------------------------- Once Drupal 7 reaches End of Life, this means: 1) The Drupal Security Team will no longer provide support or Security Advisories for Drupal 7 core and contributed modules. 2) Security issues for Drupal 7 may be disclosed in public, and zero-days (i.e, security vulnerabilities being exploited in the wild without advance warning) may occur. 3) Drupal.org will no longer support tasks related to Drupal 7 including documentation navigation, automated testing, packaging, etc 4) All Drupal 7-compatible releases on project pages will be flagged as not supported. 5) Some Drush functionality for Drupal 7 will stop working as the underlying Drupal.org infrastructure will be removed. 6) Drupal.org file archive packaging (tar and zip files) for Drupal 7 will be shut off. The archives may be removed. 7) There will be no more core commits on Drupal core 7.x. 8) Package tarballs may no longer be downloadable. 9) External vulnerability scans will flag Drupal 7 as insecure. If you are still maintaining a Drupal 7 site, we recommend migrating to Drupal 10 before the end of life date. .... Announcing the Drupal Association migration partners program The Drupal Association is working to certify migration partners to help Drupal 7 site owners. Certified Migration Partners will be promoted on Drupal.org, alongside a migration resource library, to any end users looking for help. Priority will be given to past extended support vendors and top contributors. To learn more about the Drupal 7 Certified Migration Partners visit the Drupal 7 EOL landing page [5] Coordinated By: The project lead, members of the Security team, and core committers contributed to this document. [1] https://www.drupal.org/drupal-security-team/security-risk-levels-defined [2] https://www.drupal.org/docs/develop/managing-a-drupalorg-theme-module-or-di… [3] https://donorbox.org/drupal-security [4] https://xjmdrupal.org/blog/why-sponsor-a-core-committer [5] https://www.drupal.org/about/drupal-7/end-of-life

1 0

AddToAny Share Buttons - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-019
by security-news＠drupal.org 31 May '23

31 May '23

View online: https://www.drupal.org/sa-contrib-2023-019 Project: AddToAny Share Buttons [1] Date: 2023-May-31 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: This module provides social media share & follow buttons. The module doesn't sufficiently restrict AddToAny block settings to users who have permission to administer AddToAny. This allows users with lower permission to configure malicious code leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer blocks". Solution: Install the latest version: * If you use the AddToAny Share Buttons module for Drupal 9.4+ or 10, upgrade to AddToAny 2.0.4 [3] * If you use the AddToAny Share Buttons module for Drupal versions before 9.4, upgrade to AddToAny 8.x-1.21 [4] Reported By: * Mitch Portier [5] Fixed By: * micropat [6] * Vladimir Roudakov [7] * Mitch Portier [8] Coordinated By: * Damien McKenna [9] of the Drupal Security Team [1] https://www.drupal.org/project/addtoany [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/addtoany/releases/2.0.4 [4] https://www.drupal.org/project/addtoany/releases/8.x-1.21 [5] https://www.drupal.org/user/2284182 [6] https://www.drupal.org/user/260224 [7] https://www.drupal.org/user/673120 [8] https://www.drupal.org/user/2284182 [9] https://www.drupal.org/user/108450

1 0