Security-news

security-news@drupal.org

1 participants
1782 discussions

Domain Group - Critical - Access bypass - SA-CONTRIB-2021-037
by security-news＠drupal.org 22 Sep '21

22 Sep '21

View online: https://www.drupal.org/sa-contrib-2021-037 Project: Domain Group [1] Date: 2021-September-22 Security risk: *Critical* 18∕25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: This module enables sites to define a domain from Domain Access that points directly to a group page. The module doesn't sufficiently manage the access to content administrative paths allowing an attacker to see and take actions on content (nodes) they should be allowed to. Solution: Install the latest version: * If you use the domain_group module for Drupal 8.x, upgrade to domain_group 8.x-1.04 [3] * If you use the domain_group module for Drupal 9.x, upgrade to domain_group 2.0.1 [4] Reported By: * Kalle Kipinä [5] Fixed By: * Ivan Duarte [6] * Kalle Kipinä [7] Coordinated By: * Damien McKenna [8] of the Drupal Security Team [1] https://www.drupal.org/project/domain_group [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/domain_group/releases/8.x-1.04 [4] https://www.drupal.org/project/domain_group/releases/2.0.1 [5] https://www.drupal.org/user/813328 [6] https://www.drupal.org/user/1769194 [7] https://www.drupal.org/user/813328 [8] https://www.drupal.org/u/damienmckenna

1 0

The Better Mega Menu - Moderately critical - Cross Site Scripting, Information Disclosure, Multiple vulnerabilities - SA-CONTRIB-2021-038
by security-news＠drupal.org 22 Sep '21

22 Sep '21

View online: https://www.drupal.org/sa-contrib-2021-038 Project: The Better Mega Menu [1] Date: 2021-September-22 Security risk: *Moderately critical* 12∕25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting, Information Disclosure, Multiple vulnerabilities Description: This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content. The module does not sanitize values for CSS properties that are added by admins and rendered on the front-end, allowing attackers to inject malicious code into the front-end markup. This vulnerability is mitigated by the fact that it can only be exploited by an attacker with permissions to administer TB Mega Menu, or a sophisticated anonymous user using a site-specific attack that exploits the Cross Site Request Forgery vulnerability that is fixed by this same release. Solution: Install the latest version: * If you use the TB Mega Menu module for Drupal 8.x, upgrade to TB MegaMenu 8.x-1.4 [3] Reported By: * Patrick Fey [4] Fixed By: * Patrick Fey [5] * knaffles [6] Coordinated By: * Damien McKenna [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/tb_megamenu [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/tb_megamenu/releases/8.x-1.4 [4] https://www.drupal.org/user/998680 [5] https://www.drupal.org/user/998680 [6] https://www.drupal.org/user/1140512 [7] https://www.drupal.org/u/damienmckenna [8] https://www.drupal.org/u/greggles

1 0

The Better Mega Menu - Moderately critical - Cross Site Scripting - SA-CONTRIB-2021-039
by security-news＠drupal.org 22 Sep '21

22 Sep '21

View online: https://www.drupal.org/sa-contrib-2021-039 Project: The Better Mega Menu [1] Date: 2021-September-22 Security risk: *Moderately critical* 13∕25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content. It does not sufficiently sanitize user input such that an admin with permissions to edit a menu may be able to exploit one or more Cross-Site-Scripting (XSS) vulnerabilities. This vulnerability is mitigated by the fact that an attacker must have permission to administer mega menus and/or create or edit menu links, to inject the XSS. Solution: Install the latest version: * If you use the TB Mega Menu module for Drupal 8.x, upgrade to TB MegaMenu 8.x-1.4 [3] Reported By: * Patrick Fey [4] Fixed By: * Patrick Fey [5] * Wade Stewart [6] * Greg Knaddison [7] of the Drupal Security Team * Chris Panza [8] * knaffles [9] Coordinated By: * Damien McKenna [10] of the Drupal Security Team * Greg Knaddison [11] of the Drupal Security Team [1] https://www.drupal.org/project/tb_megamenu [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/tb_megamenu/releases/8.x-1.4 [4] https://www.drupal.org/user/998680 [5] https://www.drupal.org/user/998680 [6] https://www.drupal.org/user/3190381 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/1215854 [9] https://www.drupal.org/user/1140512 [10] https://www.drupal.org/u/damienmckenna [11] https://www.drupal.org/u/greggles

1 0

The Better Mega Menu - Critical - Cross Site Request Forgery - SA-CONTRIB-2021-040
by security-news＠drupal.org 22 Sep '21

22 Sep '21

View online: https://www.drupal.org/sa-contrib-2021-040 Project: The Better Mega Menu [1] Date: 2021-September-22 Security risk: *Critical* 15∕25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Request Forgery Description: This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content. The module does not use CSRF tokens to protect routes for saving menu configurations. This vulnerability can be exploited by an anonymous user. Solution: Install the latest version: * If you use the TB Mega Menu module for Drupal 8.x, upgrade to TB MegaMenu 8.x-1.4 [3] Reported By: * Patrick Fey [4] Fixed By: * Patrick Fey [5] * knaffles [6] Coordinated By: * Damien McKenna [7] of the Drupal Security Team [1] https://www.drupal.org/project/tb_megamenu [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/tb_megamenu/releases/8.x-1.4 [4] https://www.drupal.org/user/998680 [5] https://www.drupal.org/user/998680 [6] https://www.drupal.org/user/1140512 [7] https://www.drupal.org/u/damienmckenna

1 0

The Better Mega Menu - Moderately critical - Access bypass - SA-CONTRIB-2021-041
by security-news＠drupal.org 22 Sep '21

22 Sep '21

View online: https://www.drupal.org/sa-contrib-2021-041 Project: The Better Mega Menu [1] Date: 2021-September-22 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:Default [2] Vulnerability: Access bypass Description: This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content. This module has a vulnerability whereby users can select blocks as a menu item they don't have permission to view. The vulnerability is mitigated by the fact that it can only be exploited by an attacker with the "Administer TB Mega Menu" permission. Solution: Install the latest version: * If you use the TB Mega Menu module for Drupal 8.x, upgrade to TB MegaMenu 8.x-1.4 [3] Reported By: * Patrick Fey [4] Fixed By: * Patrick Fey [5] * Henry Odiete [6] * quondam [7] Coordinated By: * Damien McKenna [8] of the Drupal Security Team [1] https://www.drupal.org/project/tb_megamenu [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/tb_megamenu/releases/8.x-1.4 [4] https://www.drupal.org/user/998680 [5] https://www.drupal.org/user/998680 [6] https://www.drupal.org/user/3578705 [7] https://www.drupal.org/user/327869 [8] https://www.drupal.org/u/damienmckenna

1 0

Taxonomy Manager - Moderately critical - Access bypass - SA-CONTRIB-2021-035
by security-news＠drupal.org 22 Sep '21

22 Sep '21

View online: https://www.drupal.org/sa-contrib-2021-035 Project: Taxonomy Manager [1] Date: 2021-September-22 Security risk: *Moderately critical* 10∕25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Description: This module provides a powerful interface for managing a taxonomy vocabulary. A vocabulary gets displayed in a dynamic tree view, where parent terms can be expanded to list their nested child terms or can be collapsed. The module does not take the correct user permissions into account, allowing an attacker to delete and move terms. The issue is mitigated by the fact that an attacker must have permission to create terms in the targeted vocabulary. Solution: Install the latest version: * If you use the Taxonomy Manager module for Drupal 8 or 9, upgrade to Taxonomy Manager 2.0.6 [3] Reported By: * Klaus Purer [4] Fixed By: * Matthias Hutterer [5] * Klaus Purer [6] * Ales Bencina [7] Coordinated By: * Damien McKenna [8] of the Drupal Security Team * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/taxonomy_manager [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/taxonomy_manager/releases/2.0.6 [4] https://www.drupal.org/user/262198 [5] https://www.drupal.org/user/59747 [6] https://www.drupal.org/user/262198 [7] https://www.drupal.org/user/3558110 [8] https://www.drupal.org/u/damienmckenna [9] https://www.drupal.org/u/greggles

1 0

Search API attachments - Critical - Arbitrary PHP code execution - SA-CONTRIB-2021-034
by security-news＠drupal.org 22 Sep '21

22 Sep '21

View online: https://www.drupal.org/sa-contrib-2021-034 Project: Search API attachments [1] Date: 2021-September-22 Security risk: *Critical* 15∕25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Default [2] Vulnerability: Arbitrary PHP code execution Description: This module enables you to extract the textual content of files for use on a website, e.g. to display it or or use it in search indexes. The module doesn't sufficiently protect the administrator-defined commands which are executed on the server, which leads to post-authentication remote code execution by a limited set of users. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer search_api". Sites are encouraged to review which roles have that permission and which users have that role, to ensure that only trusted users have that permission. Solution: Install the latest version: * If you use the search_api_attachments module for Drupal 7.x, upgrade to search_api_attachments 7.x-1.19 [3] The 8.x branch does not have Security Coverage. Reported By: * Florent Torregrosa [4] Fixed By: * Damien McKenna [5] of the Drupal Security Team * Ismaeil Abouljamal [6] Coordinated By: * Damien McKenna [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/search_api_attachments [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/search_api_attachments/releases/7.x-1.19 [4] https://www.drupal.org/user/2388214 [5] https://www.drupal.org/user/108450 [6] https://www.drupal.org/user/514568 [7] https://www.drupal.org/u/damienmckenna [8] https://www.drupal.org/u/greggles

1 0

File Extractor - Critical - Arbitrary PHP code execution - SA-CONTRIB-2021-033
by security-news＠drupal.org 22 Sep '21

22 Sep '21

View online: https://www.drupal.org/sa-contrib-2021-033 Project: File Extractor [1] Date: 2021-September-22 Security risk: *Critical* 15∕25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:Default [2] Vulnerability: Arbitrary PHP code execution Description: This module enables you to extract the textual content of files for use on a website, e.g. to display it or or use it in search indexes. The module doesn't sufficiently protect the administrator-defined commands which are executed on the server, which leads to post-authentication remote code execution by a limited set of users. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer File Extractor" to access the settings form. Sites are encouraged to review which roles have that permission and which users have that role, to ensure that only trusted users have that permission. Solution: Install the latest version: * If you use the File Extractor 2.0.2 or below, upgrade to File Extractor 2.0.3 [3] * If you use the File Extractor 3.0.0, upgrade to File Extractor 3.0.1 [4] * If you use the File Extractor 4.0.0, upgrade to File Extractor 4.0.1 [5] Reported By: * Florent Torregrosa [6] Fixed By: * Florent Torregrosa [7] Coordinated By: * Damien McKenna [8] of the Drupal Security Team [1] https://www.drupal.org/project/file_extractor [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/file_extractor/releases/2.0.3 [4] https://www.drupal.org/project/file_extractor/releases/3.0.1 [5] https://www.drupal.org/project/file_extractor/releases/4.0.1 [6] https://www.drupal.org/user/2388214 [7] https://www.drupal.org/user/2388214 [8] https://www.drupal.org/u/damienmckenna

1 0

Commerce Core - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2021-032
by security-news＠drupal.org 22 Sep '21

22 Sep '21

View online: https://www.drupal.org/sa-contrib-2021-032 Project: Commerce Core [1] Date: 2021-September-22 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass, Information Disclosure Description: This module provides a system for building an ecommerce solution in their Drupal site. The module doesn't sufficiently verify access to profile data in certain circumstances. This vulnerability is mitigated by the fact that an attacker must have permission to perform the checkout operation. Solution: Install the latest version: * If you use the Commerce module for Drupal 8.x, upgrade to Commerce 8.x-2.27 [3] Reported By: * Sasanka Jandhyala [4] Fixed By: * Sasanka Jandhyala [5] * Matt Glaman [6] * Jonathan Sacksick [7] Coordinated By: * Damien McKenna [8] of the Drupal Security Team [1] https://www.drupal.org/project/commerce [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/commerce/releases/8.x-2.27 [4] https://www.drupal.org/user/3541248 [5] https://www.drupal.org/user/3541248 [6] https://www.drupal.org/user/2416470 [7] https://www.drupal.org/user/972218 [8] https://www.drupal.org/u/damienmckenna

1 0

Client-side Hierarchical Select - Moderately critical - Cross-site scripting - SA-CONTRIB-2021-031
by security-news＠drupal.org 22 Sep '21

22 Sep '21

View online: https://www.drupal.org/sa-contrib-2021-031 Project: Client-side Hierarchical Select [1] Date: 2021-September-22 Security risk: *Moderately critical* 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross-site scripting Description: The module provides a field widget for selecting taxonomy terms in a hierarchical fashion. The module doesn't sanitize user input in certain cases, leading to a possible Cross-Site-Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit taxonomy terms to which the widget may apply. Solution: Install the latest version: * If you use the cshs module for Drupal 8 or 9, upgrade to Client-side Hierarchical Select 8.x-3.5 [3]. Reported By: * Patrick Fey [4] Fixed By: * Sergii Bondarenko [5] * Patrick Fey [6] Coordinated By: * Damien McKenna [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/cshs [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/cshs/releases/8.x-3.5 [4] https://www.drupal.org/user/998680 [5] https://www.drupal.org/user/2802285 [6] https://www.drupal.org/user/998680 [7] https://www.drupal.org/u/damienmckenna [8] https://www.drupal.org/u/greggles

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news