View online: https://www.drupal.org/sa-contrib-2021-038
Project: The Better Mega Menu [1]
Date: 2021-September-22
Security risk: *Moderately critical* 12∕25
AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2]
Vulnerability: Cross Site Scripting, Information Disclosure, Multiple
vulnerabilities
Description:
This module provides an admin interface for creating drop down menus that
combine Drupal menu items with rich media content.
The module does not sanitize values for CSS properties that are added by
admins and rendered on the front-end, allowing attackers to inject malicious
code into the front-end markup.
This vulnerability is mitigated by the fact that it can only be exploited by
an attacker with permissions to administer TB Mega Menu, or a sophisticated
anonymous user using a site-specific attack that exploits the Cross Site
Request Forgery vulnerability that is fixed by this same release.
Solution:
Install the latest version:
* If you use the TB Mega Menu module for Drupal 8.x, upgrade to TB MegaMenu
8.x-1.4 [3]
Reported By:
* Patrick Fey [4]
Fixed By:
* Patrick Fey [5]
* knaffles [6]
Coordinated By:
* Damien McKenna [7] of the Drupal Security Team
* Greg Knaddison [8] of the Drupal Security Team
[1] https://www.drupal.org/project/tb_megamenu
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/tb_megamenu/releases/8.x-1.4
[4] https://www.drupal.org/user/998680
[5] https://www.drupal.org/user/998680
[6] https://www.drupal.org/user/1140512
[7] https://www.drupal.org/u/damienmckenna
[8] https://www.drupal.org/u/greggles
View online: https://www.drupal.org/sa-contrib-2021-034
Project: Search API attachments [1]
Date: 2021-September-22
Security risk: *Critical* 15∕25
AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Default [2]
Vulnerability: Arbitrary PHP code execution
Description:
This module enables you to extract the textual content of files for use on a
website, e.g. to display it or or use it in search indexes.
The module doesn't sufficiently protect the administrator-defined commands
which are executed on the server, which leads to post-authentication remote
code execution by a limited set of users.
This vulnerability is mitigated by the fact that an attacker must have a role
with the permission "administer search_api". Sites are encouraged to review
which roles have that permission and which users have that role, to ensure
that only trusted users have that permission.
Solution:
Install the latest version:
* If you use the search_api_attachments module for Drupal 7.x, upgrade to
search_api_attachments 7.x-1.19 [3]
The 8.x branch does not have Security Coverage.
Reported By:
* Florent Torregrosa [4]
Fixed By:
* Damien McKenna [5] of the Drupal Security Team
* Ismaeil Abouljamal [6]
Coordinated By:
* Damien McKenna [7] of the Drupal Security Team
* Greg Knaddison [8] of the Drupal Security Team
[1] https://www.drupal.org/project/search_api_attachments
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/search_api_attachments/releases/7.x-1.19
[4] https://www.drupal.org/user/2388214
[5] https://www.drupal.org/user/108450
[6] https://www.drupal.org/user/514568
[7] https://www.drupal.org/u/damienmckenna
[8] https://www.drupal.org/u/greggles
View online: https://www.drupal.org/sa-contrib-2021-033
Project: File Extractor [1]
Date: 2021-September-22
Security risk: *Critical* 15∕25
AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Default [2]
Vulnerability: Arbitrary PHP code execution
Description:
This module enables you to extract the textual content of files for use on a
website, e.g. to display it or or use it in search indexes.
The module doesn't sufficiently protect the administrator-defined commands
which are executed on the server, which leads to post-authentication remote
code execution by a limited set of users.
This vulnerability is mitigated by the fact that an attacker must have a role
with the permission "Administer File Extractor" to access the settings form.
Sites are encouraged to review which roles have that permission and which
users have that role, to ensure that only trusted users have that permission.
Solution:
Install the latest version:
* If you use the File Extractor 2.0.2 or below, upgrade to File Extractor
2.0.3 [3]
* If you use the File Extractor 3.0.0, upgrade to File Extractor 3.0.1 [4]
* If you use the File Extractor 4.0.0, upgrade to File Extractor 4.0.1 [5]
Reported By:
* Florent Torregrosa [6]
Fixed By:
* Florent Torregrosa [7]
Coordinated By:
* Damien McKenna [8] of the Drupal Security Team
[1] https://www.drupal.org/project/file_extractor
[2] https://www.drupal.org/security-team/risk-levels
[3] https://www.drupal.org/project/file_extractor/releases/2.0.3
[4] https://www.drupal.org/project/file_extractor/releases/3.0.1
[5] https://www.drupal.org/project/file_extractor/releases/4.0.1
[6] https://www.drupal.org/user/2388214
[7] https://www.drupal.org/user/2388214
[8] https://www.drupal.org/u/damienmckenna