Security-news

security-news@drupal.org

1 participants
1782 discussions

Opigno Learning path - Less critical - UI redressing (clickjacking) - SA-CONTRIB-2021-018
by security-news＠drupal.org 23 Jun '21

23 Jun '21

View online: https://www.drupal.org/sa-contrib-2021-018 Project: Opigno Learning path [1] Date: 2021-June-23 Security risk: *Less critical* 9∕25 AC:Complex/A:None/CI:None/II:None/E:Theoretical/TD:All [2] Vulnerability: UI redressing (clickjacking) Description: This project is related to Opigno LMS distribution. It implements the learning path, that combines together in a very flexible way the differents steps of a training in Opigno LMS. The module does not set X-Frame-Options and blocks ability of other modules (e.g Security Kit [3]) to add them, leaving it vulnerable to Clickjacking. Solution: Install the latest version: * If you use the Opigno learning path module for Drupal 8.x, upgrade to a version greater than 8.x-1.10 Opigno learning path 8.x-1.11 or later [4] The issue was fixed in public but needed a security advisory. Users of the module are encouraged to upgrade to at least 8.x-1.11 or a later version to gain protection against this weakness. Reported By: * Bryan Butler [5] Fixed By: * James Aparicio [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team * Damien McKenna [8] of the Drupal Security Team [1] https://www.drupal.org/project/opigno_learning_path [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/seckit [4] https://www.drupal.org/project/opigno_learning_path/releases/8.x-1.11 [5] https://www.drupal.org/user/3591325 [6] https://www.drupal.org/user/2547544 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/108450

1 0

Block Content Revision UI - Moderately critical - Access bypass - SA-CONTRIB-2021-017
by security-news＠drupal.org 16 Jun '21

16 Jun '21

View online: https://www.drupal.org/sa-contrib-2021-017 Project: Block Content Revision UI [1] Date: 2021-June-16 Security risk: *Moderately critical* 11∕25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Description: This module provides a revision UI to Block Content entities. The module doesn't sufficiently respect access restrictions to certain entities when used in conjunction with specific modules. This vulnerability is mitigated by the fact that an attacker must have a role with any of the permissions provided by Block Content Revision UI, and another affected module must be enabled. Solution: Install the latest version: * If you use the Block Content Revision UI module for Drupal 8.x, upgrade to Block Content Revision UI 2.127.1 [3] Reported By: * Michael Strelan [4] Fixed By: * Michael Strelan [5] Coordinated By: * Greg Knaddison [6] of the Drupal Security Team * Lee Rowlands [7] of the Drupal Security Team * Drew Webber [8] of the Drupal Security Team [1] https://www.drupal.org/project/block_content_revision_ui [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/block_content_revision_ui/releases/2.127.1 [4] https://www.drupal.org/user/314289 [5] https://www.drupal.org/user/314289 [6] https://www.drupal.org/user/36762 [7] https://www.drupal.org/user/395439 [8] https://www.drupal.org/user/255969

1 0

Linky Revision UI - Moderately critical - Access bypass - SA-CONTRIB-2021-016
by security-news＠drupal.org 16 Jun '21

16 Jun '21

View online: https://www.drupal.org/sa-contrib-2021-016 Project: Linky Revision UI [1] Date: 2021-June-16 Security risk: *Moderately critical* 11∕25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Description: This module provides a revision UI to Linky entities. The module doesn't sufficiently respect access restrictions to certain entities when used in conjunction with specific modules. This vulnerability is mitigated by the fact that an attacker must have a role with any of the permissions provided by Linky Revision UI, and another affected module must be enabled. Solution: Install the latest version: * If you use the Linky Revision UI module for Drupal 8.x, upgrade to Linky Revision UI 2.127.1 [3] Reported By: * Michael Strelan [4] Fixed By: * Michael Strelan [5] * Lee Rowlands [6] of the Drupal Security Team Coordinated By: * Greg Knaddison [7] of the Drupal Security Team * Drew Webber [8] of the Drupal Security Team * Lee Rowlands [9] of the Drupal Security Team [1] https://www.drupal.org/project/linky_revision_ui [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/linky_revision_ui/releases/2.127.1 [4] https://www.drupal.org/user/314289 [5] https://www.drupal.org/user/314289 [6] https://www.drupal.org/user/395439 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/255969 [9] https://www.drupal.org/user/395439

1 0

Chaos Tool Suite (ctools) - Moderately critical - Access bypass - SA-CONTRIB-2021-015
by security-news＠drupal.org 16 Jun '21

16 Jun '21

View online: https://www.drupal.org/sa-contrib-2021-015 Project: Chaos Tool Suite (ctools) [1] Date: 2021-June-16 Security risk: *Moderately critical* 13∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Description: Chaos tool suite (ctools) module provides a number of APIs and extensions for Drupal, it's 8.x-3.x branch is a start from scratch to evaluate the features of ctools that didn't make it into Drupal Core 8.0.x and port them. The module doesn't sufficiently handle block access control on its EntityView plugin. This is a followup to more fully implement the fixes from SA-CONTRIB-2021-009 [3] This vulnerability is mitigated by the fact that successful exploitation requires special conditions in place such as custom blockAccess() method that differs from the default return value of 'AccessResult::allowed()' and extending from EntityView. Solution: Install the latest version: * If you use the CTools module for Drupal 8.x, upgrade to CTools 8.x-3.7 [4] Reported By: * Michael Vanetta [5] Fixed By: * Michael Vanetta [6] * Joël Pittet [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team * Drew Webber [9] of the Drupal Security Team [1] https://www.drupal.org/project/ctools [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/sa-contrib-2021-009 [4] https://www.drupal.org/project/ctools/releases/8.x-3.7 [5] https://www.drupal.org/user/452914 [6] https://www.drupal.org/user/452914 [7] https://www.drupal.org/user/160302 [8] https://www.drupal.org/user/36762 [9] https://www.drupal.org/user/255969

1 0

OpenID Connect / OAuth client - Moderately critical - Access bypass - SA-CONTRIB-2021-014
by security-news＠drupal.org 02 Jun '21

02 Jun '21

View online: https://www.drupal.org/sa-contrib-2021-014 Project: OpenID Connect / OAuth client [1] Date: 2021-June-02 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: This module allows users to authenticate against an Oauth 2.0 / OpenID Connect identity provider to login to your Drupal site. The module doesn't sufficiently protect against unauthorized local access, by way of using the 'password reset' facility, for users who are supposed to only be able to log in through the identity provider. This creates a scenario where after such a user is blocked from logging in through the identity provider but not explicitly blocked in Drupal, they are still able to log in by sending themselves a Drupal 'password reset' e-mail. Solution: Install the latest version: * If you use the openid_connect module for Drupal 8/9, upgrade to openid_connect 8.x-1.1 [3] * If you use the openid_connect module for Drupal 7, upgrade to openid_connect 7.x-1.0 [4] Reported By: * Jeffrey Bertoen [5] Fixed By: * João Ventura [6] * Philip Frilling [7] * Jeffrey Bertoen [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team * Drew Webber [10] of the Drupal Security Team [1] https://www.drupal.org/project/openid_connect [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/openid_connect/releases/8.x-1.1 [4] https://www.drupal.org/project/openid_connect/releases/7.x-1.0 [5] https://www.drupal.org/user/2733365 [6] https://www.drupal.org/user/122464 [7] https://www.drupal.org/user/169695 [8] https://www.drupal.org/user/2733365 [9] https://www.drupal.org/user/36762 [10] https://www.drupal.org/user/255969

1 0

GraphQL - Moderately critical - Information Disclosure - SA-CONTRIB-2021-013
by security-news＠drupal.org 02 Jun '21

02 Jun '21

View online: https://www.drupal.org/sa-contrib-2021-013 Project: GraphQL [1] Date: 2021-June-02 Security risk: *Moderately critical* 11∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Information Disclosure Description: This module lets you craft and expose a GraphQL web service API. The module does not sufficiently protect arbitrary exception and error messages thereby exposing an information disclosure vulnerability. This vulnerability is mitigated by the fact that a GraphQL server must be enabled and a data producer be configured that throws exceptions with confidential error messages that must not be exposed over the GraphQL API. Solution: Install the latest version: * If you use the GraphQL module for Drupal 8.x, upgrade to GraphQL 8.x-4.1 [3] Reported By: * Alex Tkachev [4] Fixed By: * Klaus Purer [5] * Radoslav Terezka [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team [1] https://www.drupal.org/project/graphql [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/graphql/releases/8.x-4.1 [4] https://www.drupal.org/user/390336 [5] https://www.drupal.org/user/262198 [6] https://www.drupal.org/user/741876 [7] https://www.drupal.org/user/36762

1 0

Frequently Asked Questions - Moderately critical - Cross Site Scripting - SA-CONTRIB-2021-012
by security-news＠drupal.org 02 Jun '21

02 Jun '21

View online: https://www.drupal.org/sa-contrib-2021-012 Project: Frequently Asked Questions [1] Date: 2021-June-02 Security risk: *Moderately critical* 11∕25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: The Frequently Asked Questions (faq) module allows users, with appropriate permissions, to create question and answer pairs which they want displayed on the 'faq' page. The 'faq' page is automatically generated from the FAQ nodes configured. Basic Views layouts are also provided and can be customised via the Views UI (rather than via the module settings page). The module doesn't sufficiently sanitize editor input leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the "create faq content" permission. Solution: Install the latest version: * If you use the Frequently Asked Questions module for Drupal 7.x, upgrade to Frequently Asked Questions 7.x-1.3 [3] Reported By: * Mitch Portier [4] Fixed By: * Mitch Portier [5] * Mohammed Razem [6] * Vijay Mani [7] Provisional Member of the Drupal Security Team Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/faq [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/faq/releases/7.x-1.3 [4] https://www.drupal.org/user/2284182 [5] https://www.drupal.org/user/2284182 [6] https://www.drupal.org/user/255384 [7] https://www.drupal.org/user/93488 [8] https://www.drupal.org/user/36762

1 0

Open Social - Critical - Authentication Bypass - SA-CONTRIB-2021-011
by security-news＠drupal.org 02 Jun '21

02 Jun '21

View online: https://www.drupal.org/sa-contrib-2021-011 Project: Open Social [1] Date: 2021-June-02 Security risk: *Critical* 15∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Authentication Bypass Description: Open Social is a Drupal distribution for online communities. The included social_magic_login module doesn't sufficiently validate magic login URLs for user accounts. The lack of validation makes it possible for an adversary to forge valid login URLs and login to such an account. This vulnerability is mitigated by the fact the module social_magic_login needs to be enabled. Solution: Install the latest version of Open Social: * If you use the Open Social distribution for Drupal 10.0.x, upgrade to Open Social 10.0.13 [3] * If you use the Open Social distribution for Drupal 10.1.x, upgrade to Open social 10.1.6 [4] Alternatively, disable the module social_magic_login. Reported By: * Ronald te Brake [5] * Alexander Varwijk [6] * Robert Ragas [7] Fixed By: * Ronald te Brake [8] * Alexander Varwijk [9] * Robert Ragas [10] Coordinated By: * Greg Knaddison [11] of the Drupal Security Team [1] https://www.drupal.org/project/social [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/social/releases/10.0.13 [4] https://www.drupal.org/project/social/releases/10.1.6 [5] https://www.drupal.org/user/2314038 [6] https://www.drupal.org/user/1868952 [7] https://www.drupal.org/user/2723261 [8] https://www.drupal.org/user/2314038 [9] https://www.drupal.org/user/1868952 [10] https://www.drupal.org/user/2723261 [11] https://www.drupal.org/user/36762

1 0

Open Social - Moderately critical - SQL Injection - SA-CONTRIB-2021-010
by security-news＠drupal.org 02 Jun '21

02 Jun '21

View online: https://www.drupal.org/sa-contrib-2021-010 Project: Open Social [1] Date: 2021-June-02 Security risk: *Moderately critical* 11∕25 AC:Complex/A:User/CI:All/II:None/E:Theoretical/TD:Default [2] Vulnerability: SQL Injection Description: This Open Social distribution provides a turn-key system for building customized social networks. The module doesn't sufficiently process data in certain circumstances. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access mentions". Solution: Install the latest version: * If you use Open Social 9.x, upgrade to 8.x-9.17 [3] * If you use Open Social 10.0.x, upgrade to 10.0.13 [4] * If you use Open Social 10.1.x, upgrade to 10.1.6 [5] Reported By: * mindaugasd [6] Fixed By: * mindaugasd [7] * Alexander Varwijk [8] * Drew Webber [9] of the Drupal Security Team * Ronald te Brake [10] * Neil Drumm [11] of the Drupal Security Team Coordinated By: * Greg Knaddison [12] of the Drupal Security Team [1] https://www.drupal.org/project/social [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/social/releases/8.x-9.17 [4] https://www.drupal.org/project/social/releases/10.0.13 [5] https://www.drupal.org/project/social/releases/10.1.6 [6] https://www.drupal.org/user/330097 [7] https://www.drupal.org/user/330097 [8] https://www.drupal.org/user/1868952 [9] https://www.drupal.org/user/255969 [10] https://www.drupal.org/user/2314038 [11] https://www.drupal.org/user/3064 [12] https://www.drupal.org/user/36762

1 0

Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2021-003
by security-news＠drupal.org 27 May '21

27 May '21

View online: https://www.drupal.org/sa-core-2021-003 Project: Drupal core [1] Date: 2021-May-26 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:Default [2] Vulnerability: Cross Site Scripting Description: Drupal core uses the third-party CKEditor library. This library has an error in parsing HTML that could lead to an XSS attack. CKEditor 4.16.1 and later include the fix. Users of the CKEditor library via means other than Drupal core should update their 3rd party code (e.g. the WYSIWYG module for Drupal 7). The Drupal Security Team policy is not to alert for issues affecting 3rd party libraries unless those are shipped with Drupal core. See DRUPAL-SA-PSA-2016-004 for more details [3]. This issue is mitigated by the fact that it only affects sites with CKEditor enabled. Solution: Install the latest version: * If you are using Drupal 9.1, update to Drupal 9.1.9 [4]. * If you are using Drupal 9.0, update to Drupal 9.0.14 [5]. * If you are using Drupal 8.9, update to Drupal 8.9.16 [6]. Versions of Drupal 8 prior to 8.9.x are end-of-life and do not receive security coverage. Reported By: * Or Sahar [7] Fixed By: * Greg Knaddison [8] of the Drupal Security Team * Jess [9] of the Drupal Security Team * Krzysztof Krzton [10] * Lee Rowlands [11] of the Drupal Security Team * Michael Hess [12] of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/psa-2016-004 [4] https://www.drupal.org/project/drupal/releases/9.1.9 [5] https://www.drupal.org/project/drupal/releases/9.0.14 [6] https://www.drupal.org/project/drupal/releases/8.9.16 [7] https://www.drupal.org/user/3676145 [8] https://www.drupal.org/user/36762 [9] https://www.drupal.org/user/65776 [10] https://www.drupal.org/user/3618903 [11] https://www.drupal.org/user/395439 [12] https://www.drupal.org/user/102818

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news