Security-news

security-news@drupal.org

1 participants
1782 discussions

User hash - Moderately critical - Cache poisoning - SA-CONTRIB-2021-030
by security-news＠drupal.org 22 Sep '21

22 Sep '21

View online: https://www.drupal.org/sa-contrib-2021-030 Project: User hash [1] Date: 2021-September-22 Security risk: *Moderately critical* 12∕25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Cache poisoning Description: This module enables you to create an individual hash for each user. These hashes can be used for authentication instead of the user's password, e.g. for views exporters. The module doesn't sufficiently invalidate page output when the page_cache module is used. This vulnerability is mitigated by the fact that an attacker must have a user hash that grants access to specific content and the attack must be timed to the reset of the page cache. Solution: Install the latest version: * If you use the user_hash module for Drupal 8 or 9, upgrade to User Hash 2.0.1 [3] Reported By: * Jürgen Haas [4] * Lee Rowlands [5] of the Drupal Security Team Fixed By: * Jürgen Haas [6] * Lee Rowlands [7] of the Drupal Security Team Coordinated By: * Damien McKenna [8] of the Drupal Security Team [1] https://www.drupal.org/project/user_hash [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/user_hash/releases/2.0.1 [4] https://www.drupal.org/user/168924 [5] https://www.drupal.org/user/395439 [6] https://www.drupal.org/user/168924 [7] https://www.drupal.org/user/395439 [8] https://www.drupal.org/u/damienmckenna

1 0

GraphQL - Moderately critical - Access bypass - SA-CONTRIB-2021-029
by security-news＠drupal.org 15 Sep '21

15 Sep '21

View online: https://www.drupal.org/sa-contrib-2021-029 Project: GraphQL [1] Date: 2021-September-15 Security risk: *Moderately critical* 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass CVE IDs: CVE-2020-13675 Description: This advisory addresses a similar issue to Drupal core - Moderately critical - Access bypass - SA-CORE-2021-008 [3]. The GraphQL module allows file uploads through its HTTP API. The module does not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site. This vulnerability is mitigated by four factors: 1) The GraphQL module must be enabled on the site. 2) The GraphQL schema must expose a file upload by using the helper "src/GraphQL/Utility/FileUpload.php" in the module. 3) An attacker must have access to that file upload via the GraphQL API. 4) The site must employ a file validation module. Solution: Install the latest version: * If you use the GraphQL module 8.x-4.x for Drupal 8.x or 9.x, upgrade to GraphQL 8.x-4.2 [4] * If you use the GraphQL module 8.x-3.x for Drupal 8.x no action is needed as a result of this advisory as the 8.x-3.x branch is not affected by this issue. Reported By: * Klaus Purer [5] Fixed By: * Klaus Purer [6] * Jess [7] of the Drupal Security Team * pmelab [8] * Drew Webber [9] of the Drupal Security Team * Lee Rowlands [10] of the Drupal Security Team * Alex Pott [11] of the Drupal Security Team * Samuel Mortenson [12] * Kim Pepper [13] Coordinated By: * xjm [14] of the Drupal Security Team * Drew Webber [15] of the Drupal Security Team [1] https://www.drupal.org/project/graphql [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/sa-core-2021-008 [4] https://www.drupal.org/project/graphql/releases/8.x-4.2 [5] https://www.drupal.org/user/262198 [6] https://www.drupal.org/user/262198 [7] https://www.drupal.org/user/65776 [8] https://www.drupal.org/user/555322 [9] https://www.drupal.org/user/255969 [10] https://www.drupal.org/user/395439 [11] https://www.drupal.org/user/157725 [12] https://www.drupal.org/user/2582268 [13] https://www.drupal.org/user/370574 [14] https://www.drupal.org/u/xjm [15] https://www.drupal.org/u/mcdruid

1 0

Entity Embed - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2021-028
by security-news＠drupal.org 15 Sep '21

15 Sep '21

View online: https://www.drupal.org/sa-contrib-2021-028 Project: Entity Embed [1] Date: 2021-September-15 Security risk: *Moderately critical* 11∕25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Request Forgery CVE IDs: CVE-2020-13673 Description: This advisory addresses a similar issue to Drupal core - Moderately critical - Cross Site Request Forgery - SA-CORE-2021-006 [3]. The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to cross-site scripting. Solution: Install the latest version: * If you use the Entity Embed module for Drupal 8 or 9, upgrade to Entity Embed 8.x-1.2 [4]. Drupal 7 versions of Entity Embed do not have a stable release and therefore do not receive security coverage. Reported By: * Aaron Zinck [5] Fixed By: * Jess [6] of the Drupal Security Team * Adam G-H [7] * Drew Webber [8] of the Drupal Security Team Coordinated By: * xjm [9] of the Drupal Security Team * Drew Webber [10] of the Drupal Security Team [1] https://www.drupal.org/project/entity_embed [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/sa-core-2021-006 [4] https://www.drupal.org/project/entity_embed/releases/8.x-1.2 [5] https://www.drupal.org/user/518662 [6] https://www.drupal.org/user/65776 [7] https://www.drupal.org/user/205645 [8] https://www.drupal.org/user/255969 [9] https://www.drupal.org/u/xjm [10] https://www.drupal.org/u/mcdruid

1 0

Drupal core - Moderately critical - Access Bypass - SA-CORE-2021-010
by security-news＠drupal.org 15 Sep '21

15 Sep '21

View online: https://www.drupal.org/sa-core-2021-010 Project: Drupal core [1] Date: 2021-September-15 Security risk: *Moderately critical* 12∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access Bypass CVE IDs: CVE-2020-13677 Description: Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass. Sites that do not have the JSON:API module enabled are not affected. This advisory is not covered by Drupal Steward [3]. Solution: Install the latest version: * If you are using Drupal 9.2, update to Drupal 9.2.6 [4]. * If you are using Drupal 9.1, update to Drupal 9.1.13 [5]. * If you are using Drupal 8.9, update to Drupal 8.9.19 [6]. Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage. Drupal 7 core does not include the JSON:API module and therefore is not affected. Reported By: * Brad Jones [7] Fixed By: * Brad Jones [8] * Jess [9] of the Drupal Security Team * Björn Brala [10] * Gabe Sullice [11] * Mateu Aguiló Bosch [12] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/steward [4] https://www.drupal.org/project/drupal/releases/9.2.6 [5] https://www.drupal.org/project/drupal/releases/9.1.13 [6] https://www.drupal.org/project/drupal/releases/8.9.19 [7] https://www.drupal.org/user/405824 [8] https://www.drupal.org/user/405824 [9] https://www.drupal.org/user/65776 [10] https://www.drupal.org/user/3366066 [11] https://www.drupal.org/user/2287430 [12] https://www.drupal.org/user/550110

1 0

Drupal core - Moderately critical - Access bypass - SA-CORE-2021-009
by security-news＠drupal.org 15 Sep '21

15 Sep '21

View online: https://www.drupal.org/sa-core-2021-009 Project: Drupal core [1] Date: 2021-September-15 Security risk: *Moderately critical* 10∕25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass CVE IDs: CVE-2020-13676 Description: The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. This advisory is not covered by Drupal Steward [3]. Solution: Install the latest version: * If you are using Drupal 9.2, update to Drupal 9.2.6 [4]. * If you are using Drupal 9.1, update to Drupal 9.1.13 [5]. * If you are using Drupal 8.9, update to Drupal 8.9.19 [6]. Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage. Drupal 7 core does not include the QuickEdit module and therefore is not affected. Uninstalling the QuickEdit module will also mitigate the vulnerability. Site owners may wish to consider this option as the QuickEdit module will be removed from core in Drupal 10 [7]. Reported By: * Greg Watson [8] Fixed By: * Greg Watson [9] * Wim Leers [10] * Jess [11] of the Drupal Security Team * Alex Bronstein [12] of the Drupal Security Team * Lee Rowlands [13] of the Drupal Security Team * Joseph Zhao [14] * Vijay Mani [15] * Adam G-H [16] * Drew Webber [17] of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/steward [4] https://www.drupal.org/project/drupal/releases/9.2.6 [5] https://www.drupal.org/project/drupal/releases/9.1.13 [6] https://www.drupal.org/project/drupal/releases/8.9.19 [7] https://www.drupal.org/node/3227039 [8] https://www.drupal.org/user/2212910 [9] https://www.drupal.org/user/2212910 [10] https://www.drupal.org/user/99777 [11] https://www.drupal.org/user/65776 [12] https://www.drupal.org/user/78040 [13] https://www.drupal.org/user/395439 [14] https://www.drupal.org/user/1987218 [15] https://www.drupal.org/user/93488 [16] https://www.drupal.org/user/205645 [17] https://www.drupal.org/user/255969

1 0

Drupal core - Moderately critical - Access bypass - SA-CORE-2021-008
by security-news＠drupal.org 15 Sep '21

15 Sep '21

View online: https://www.drupal.org/sa-core-2021-008 Project: Drupal core [1] Date: 2021-September-15 Security risk: *Moderately critical* 11∕25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass CVE IDs: CVE-2020-13675 Description: Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site. This vulnerability is mitigated by three factors: 1) The JSON:API or REST File upload modules must be enabled on the site. 2) An attacker must have access to a file upload via JSON:API or REST. 3) The site must employ a file validation module. This advisory is not covered by Drupal Steward [3]. Also see GraphQL - Moderately critical - Access bypass - SA-CONTRIB-2021-029 [4] which addresses a similar vulnerability for that module. Solution: Install the latest version: * If you are using Drupal 9.2, update to Drupal 9.2.6 [5]. * If you are using Drupal 9.1, update to Drupal 9.1.13 [6]. * If you are using Drupal 8.9, update to Drupal 8.9.19 [7]. Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage. Drupal 7 core is not affected. Reported By: * Klaus Purer [8] Fixed By: * Klaus Purer [9] * Lee Rowlands [10] of the Drupal Security Team * Alex Pott [11] of the Drupal Security Team * Jess [12] of the Drupal Security Team * Samuel Mortenson [13] * Drew Webber [14] of the Drupal Security Team * Kim Pepper [15] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/steward [4] https://www.drupal.org/sa-contrib-2021-029 [5] https://www.drupal.org/project/drupal/releases/9.2.6 [6] https://www.drupal.org/project/drupal/releases/9.1.13 [7] https://www.drupal.org/project/drupal/releases/8.9.19 [8] https://www.drupal.org/user/262198 [9] https://www.drupal.org/user/262198 [10] https://www.drupal.org/user/395439 [11] https://www.drupal.org/user/157725 [12] https://www.drupal.org/user/65776 [13] https://www.drupal.org/user/2582268 [14] https://www.drupal.org/user/255969 [15] https://www.drupal.org/user/370574

1 0

Drupal core - Moderately critical - Cross Site Request Forgery - SA-CORE-2021-007
by security-news＠drupal.org 15 Sep '21

15 Sep '21

View online: https://www.drupal.org/sa-core-2021-007 Project: Drupal core [1] Date: 2021-September-15 Security risk: *Moderately critical* 14∕25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Request Forgery CVE IDs: CVE-2020-13674 Description: The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues. Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. Removing the "access in-place editing" permission from untrusted users *will not* fully mitigate the vulnerability. This advisory is not covered by Drupal Steward [3]. Solution: Install the latest version: * If you are using Drupal 9.2, update to Drupal 9.2.6 [4]. * If you are using Drupal 9.1, update to Drupal 9.1.13 [5]. * If you are using Drupal 8.9, update to Drupal 8.9.19 [6]. Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage. Drupal 7 core does not include the QuickEdit module and therefore is not affected. Uninstalling the QuickEdit module will also mitigate the vulnerability. Site owners may wish to consider this option as the QuickEdit module will be removed from core in Drupal 10 [7]. Reported By: * Samuel Mortenson [8] Fixed By: * Wim Leers [9] * Greg Knaddison [10] of the Drupal Security Team * Jess [11] of the Drupal Security Team * Lee Rowlands [12] of the Drupal Security Team * Vijay Mani [13] * Heine [14] of the Drupal Security Team * Alex Bronstein [15] of the Drupal Security Team * Adam G-H [16] * Drew Webber [17] of the Drupal Security Team * Théodore Biadala [18] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/steward [4] https://www.drupal.org/project/drupal/releases/9.2.6 [5] https://www.drupal.org/project/drupal/releases/9.1.13 [6] https://www.drupal.org/project/drupal/releases/8.9.19 [7] https://www.drupal.org/node/3227039 [8] https://www.drupal.org/user/2582268 [9] https://www.drupal.org/user/99777 [10] https://www.drupal.org/user/36762 [11] https://www.drupal.org/user/65776 [12] https://www.drupal.org/user/395439 [13] https://www.drupal.org/user/93488 [14] https://www.drupal.org/user/17943 [15] https://www.drupal.org/user/78040 [16] https://www.drupal.org/user/205645 [17] https://www.drupal.org/user/255969 [18] https://www.drupal.org/user/598310

1 0

Drupal core - Moderately critical - Cross Site Request Forgery - SA-CORE-2021-006
by security-news＠drupal.org 15 Sep '21

15 Sep '21

View online: https://www.drupal.org/sa-core-2021-006 Project: Drupal core [1] Date: 2021-September-15 Security risk: *Moderately critical* 10∕25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Request Forgery CVE IDs: CVE-2020-13673 Description: The Drupal core Media module provides a filter to allow embedding internal and external media in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed media. In some cases, this could lead to cross-site scripting. This advisory is not covered by Drupal Steward [3]. Also see Entity Embed - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2021-028 [4] which addresses a similar vulnerability for that module. Solution: Install the latest version: * If you are using Drupal 9.2, update to Drupal 9.2.6 [5]. * If you are using Drupal 9.1, update to Drupal 9.1.13 [6]. * If you are using Drupal 8.9, update to Drupal 8.9.19 [7]. Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage. Drupal 7 core is not affected. Reported By: * Aaron Zinck [8] Fixed By: * Aaron Zinck [9] * Sean Blommaert [10] * Alex Bronstein [11] of the Drupal Security Team * Marcos Cano [12] * Lee Rowlands [13] of the Drupal Security Team * Adam G-H [14] * Jess [15] of the Drupal Security Team * Drew Webber [16] of the Drupal Security Team * Neil Drumm [17] of the Drupal Security Team * Brian Tofte-Schumacher [18] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/steward [4] https://www.drupal.org/sa-contrib-2021-028 [5] https://www.drupal.org/project/drupal/releases/9.2.6 [6] https://www.drupal.org/project/drupal/releases/9.1.13 [7] https://www.drupal.org/project/drupal/releases/8.9.19 [8] https://www.drupal.org/user/518662 [9] https://www.drupal.org/user/518662 [10] https://www.drupal.org/user/545912 [11] https://www.drupal.org/user/78040 [12] https://www.drupal.org/user/1288796 [13] https://www.drupal.org/user/395439 [14] https://www.drupal.org/user/205645 [15] https://www.drupal.org/user/65776 [16] https://www.drupal.org/user/255969 [17] https://www.drupal.org/user/3064 [18] https://www.drupal.org/user/3525810

1 0

Webform - Moderately critical - Cross Site Scripting - SA-CONTRIB-2021-026
by security-news＠drupal.org 25 Aug '21

25 Aug '21

View online: https://www.drupal.org/sa-contrib-2021-026 Project: Webform [1] Date: 2021-August-25 Security risk: *Moderately critical* 12∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross Site Scripting Description: The Webform module uses the CKEditor [3], library for WYSIWYG editing. CKEditor has released a security update that impacts Webform [4]. An attacker that can create or edit content (even without access to CKEditor themselves) may be able to exploit one or more Cross-Site Scripting (XSS) vulnerabilities to target users with access to the WYSIWYG CKEditor, including site admins with privileged access. For more information, see CKEditor's announcement of the release [5]. Solution: Install the latest version: * If you use the Webform module module for Drupal 8/9 upgrade to Webform 8.x-5.28 [6] or Webform 6.0.5 [7] If you are using a previous release of the Webform module you can immediately do one of several options. 1) Update Drupal 2) If you are using Composer, run drush webform:libraries:composer > DRUPAL_ROOT/composer.libraries.json and run composer update 3) If you are using Drush, run drush webform:libraries:update Learn more about updating Webform libraries. [8] Reported By: * Lee Rowlands [9] of the Drupal Security Team Fixed By: * Jacob Rockowitz [10] Coordinated By: * Greg Knaddison [11] of the Drupal Security Team * xjm [12] of the Drupal Security Team [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://github.com/ckeditor/ckeditor4 [4] https://ckeditor.com/blog/ckeditor-4.16.2-with-browser-improvements-and-sec… [5] https://ckeditor.com/blog/ckeditor-4.16.2-with-browser-improvements-and-sec… [6] https://www.drupal.org/project/webform/releases/8.x-5.28 [7] https://www.drupal.org/project/webform/releases/6.0.5 [8] https://www.drupal.org/docs/contributed-modules/webform/webform-libraries [9] https://www.drupal.org/user/395439 [10] https://www.drupal.org/user/371407 [11] https://www.drupal.org/user/36762 [12] https://www.drupal.org/user/65776

1 0

Admin Toolbar - Moderately critical - Cross Site Scripting, Access Bypass - SA-CONTRIB-2021-025
by security-news＠drupal.org 25 Aug '21

25 Aug '21

View online: https://www.drupal.org/sa-contrib-2021-025 Project: Admin Toolbar [1] Date: 2021-August-25 Security risk: *Moderately critical* 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Scripting, Access Bypass Description: The /Admin Toolbar/ (admin_toolbar) module extends the default toolbar provided by Drupal Core with various features facilitating day-to-day editorial and administrative work. The /Admin Toolbar Search/ sub-module of this module * doesn't sanitize user input in certain cases, which leads to a Cross-Site-Scripting (XSS) vulnerability. An attacker that can create or edit certain entities, entity bundles or entity types may be able to exploit one or more Cross-Site-Scripting (XSS) vulnerabilities to target users with access to the /Admin Toolbar Search/ search box, including site admins with privileged access. * doesn't properly check access in certain cases, which may result in an information disclosure vulnerability of entity type and bundle labels. The vulnerability is mitigated by the facts, that: * the /Admin Toolbar Search/ sub-module must be enabled. * an attacker must have one of several permissions, of which at least some are commonly only assigned to either editors, site builders or administrators. * a targeted account must have permission to use the search box provided by the /Admin Toolbar Search/ sub-module. Solution: Install the latest version: * If you use admin_toolbar 3.0.0 or later, upgrade to Admin Toolbar 3.0.2 [3]. * If you use admin_toolbar 8.x-2.0 or later, upgrade to Admin Toolbar 8.x-2.5 [4]. Also see the Admin Toolbar project page [5]. Reported By: * Patrick Fey [6] Fixed By: * Romain Jarraud [7] * Patrick Fey [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/admin_toolbar [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/admin_toolbar/releases/3.0.2 [4] https://www.drupal.org/project/admin_toolbar/releases/8.x-2.5 [5] https://www.drupal.org/project/admin_toolbar/ [6] https://www.drupal.org/user/998680 [7] https://www.drupal.org/user/370706 [8] https://www.drupal.org/user/998680 [9] https://www.drupal.org/user/36762

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news