Security-news

security-news@drupal.org

1 participants
1782 discussions

Webform - Moderately critical - Cross site scripting - SA-CONTRIB-2020-013
by security-news＠drupal.org 06 May '20

06 May '20

View online: https://www.drupal.org/sa-contrib-2020-013 Project: Webform [1] Date: 2020-May-06 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Description: The Webform module allows site builders to create forms. The module doesn't sufficiently prevent malicious code from being render via an options elements (i.e select menu, checkboxes, radios, etc...) under the scenario where the site builder allows the raw option value to be displayed. This vulnerability is mitigated by the fact that site builder must be allowed to build webform and select raw as the options element's submission display. Solution: Install the latest version: * If you use the Webform module for Drupal 8, upgrade to Webform 8.x-5.11 [3] Also see the Webform [4] project page. Reported By: * Dan Chadwick [5] Fixed By: * Jacob Rockowitz [6] * Dan Chadwick [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/8.x-5.11 [4] https://www.drupal.org/project/webform [5] https://www.drupal.org/user/504278 [6] https://www.drupal.org/user/371407 [7] https://www.drupal.org/user/504278 [8] https://www.drupal.org/user/36762

1 0

Webform - Moderately critical - Access bypass - SA-CONTRIB-2020-012
by security-news＠drupal.org 06 May '20

06 May '20

View online: https://www.drupal.org/sa-contrib-2020-012 Project: Webform [1] Date: 2020-May-06 Security risk: *Moderately critical* 13∕25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Description: This module enables you to build forms and surveys in Drupal. The module doesn't sufficiently validate data submitted into Webform Signature element during webform submission creation. This allows a malicious user to generate and extract HMAC hashes for arbitrary data. Such HMAC hashes are used across multiple spots in Drupal 8 core and contrib modules. An extracted HMAC hash could be used to view restricted site content or log in as another user in certain situations. This vulnerability is mitigated by the fact that an attacker must be able to create a webform submission with "Signature" element and then be able to view the submission. For Drupal instances that have "Signature" webform element available to users with low trust, it is advised to change the value of the hash salt within settings.php file to a new random value. Below we reference the specific extract from settings.php that is advised for change in such Drupal instances: /** * Salt for one-time login links, cancel links, form tokens, etc. * * This variable will be set to a random value by the installer. All one-time * login links will be invalidated if the value is changed. Note that if your * site is deployed on a cluster of web servers, you must ensure that this * variable has the same value on each server. * * For enhanced security, you may set this variable to the contents of a file * outside your document root; you should also ensure that this file is not * stored with backups of your database. * * Example: * @code * $settings['hash_salt'] = file_get_contents('/home/example/salt.txt'); * @endcode */ $settings['hash_salt'] = 'new-value-here'; Solution: Install the latest version: * If you use the Webform module for Drupal 8, upgrade to Webform 8.x-5.11 [3] Also see the Webform [4] project page. Reported By: * Heine [5] of the Drupal Security Team Fixed By: * Jacob Rockowitz [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/8.x-5.11 [4] https://www.drupal.org/project/webform [5] https://www.drupal.org/user/17943 [6] https://www.drupal.org/user/371407 [7] https://www.drupal.org/user/36762

1 0

Webform - Critical - Remote Code Execution - SA-CONTRIB-2020-011
by security-news＠drupal.org 06 May '20

06 May '20

View online: https://www.drupal.org/sa-contrib-2020-011 Project: Webform [1] Date: 2020-May-06 Security risk: *Critical* 17∕25 AC:Basic/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Remote Code Execution Description: This module enables you to build forms and surveys in Drupal. The module doesn't sufficiently filter webform element properties (attributes) under the scenario of editing a webform. Malicious user could craft such an attribute (#element_validate, for example) that would invoke execution of undesired PHP code. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Edit own webform" (or "Edit any webform"). Solution: Install the latest version: * If you use the Webform module for Drupal 8, upgrade to Webform 8.x-5.11 [3] Also see the Webform [4] project page. Reported By: * Jacob Rockowitz [5] Fixed By: * Jacob Rockowitz [6] * Heine [7] of the Drupal Security Team * bucefal91 [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/webform/releases/8.x-5.11 [4] https://www.drupal.org/project/webform [5] https://www.drupal.org/user/371407 [6] https://www.drupal.org/user/371407 [7] https://www.drupal.org/user/17943 [8] https://www.drupal.org/user/504128 [9] https://www.drupal.org/user/36762

1 0

JSON:API - Critical - Unsupported - SA-CONTRIB-2020-010
by security-news＠drupal.org 15 Apr '20

15 Apr '20

View online: https://www.drupal.org/sa-contrib-2020-010 Project: JSON:API [1] Version: 8.x-1.26 Date: 2020-April-15 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: This module provides a JSON API standards-compliant API for accessing and manipulating Drupal content and configuration entities. The security team and module maintainers are marking this project unsupported. Both the 8.x-1.x and 8.x-2.x versions are unsupported, and users of either version are strongly encouraged to upgrade to a supported version of Drupal core, which includes a supported version of JSON:API. The eventual removal of security coverage for the JSON:API contributed module was announced with the release of JSON:API 8.x-1.22 [3] on 28 June 2018. Additionally, there is a known security issue with the 8.x-1.x branch of the project that will not be fixed by the maintainers. That issue is not present in the 8.x-2.x branch of the project, nor is it present in Drupal core. Solution: Users of the module are encouraged to upgrade to a supported version of Drupal core, which is distributed with a supported version of JSON:API. If your site is currently using a release from the 8.x-1.x branch of the module, you may be required to apply fixes for the breaking changes documented here [4]. Also see the JSON:API [5] project page. Reported By: * Gabe Sullice [6] * Alex Bronstein [7] * Wim Leers [8] * Mateu Aguiló Bosch [9] Fixed By: * Gabe Sullice [10] * Alex Bronstein [11] * Wim Leers [12] * Mateu Aguiló Bosch [13] Coordinated By: * Greg Knaddison [14] of the Drupal Security Team [1] https://www.drupal.org/project/jsonapi [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/jsonapi/releases/8.x-1.22 [4] https://www.drupal.org/list-changes/jsonapi/published?to_branch=8.x-2.x [5] https://www.drupal.org/project/jsonapi [6] https://www.drupal.org/user/2287430 [7] https://www.drupal.org/user/78040 [8] https://www.drupal.org/user/99777 [9] https://www.drupal.org/user/550110 [10] https://www.drupal.org/user/2287430 [11] https://www.drupal.org/user/78040 [12] https://www.drupal.org/user/99777 [13] https://www.drupal.org/user/550110 [14] https://www.drupal.org/user/36762

1 0

Spamicide - Critical - Access bypass - SA-CONTRIB-2020-009
by security-news＠drupal.org 08 Apr '20

08 Apr '20

View online: https://www.drupal.org/sa-contrib-2020-009 Project: Spamicide [1] Date: 2020-April-08 Security risk: *Critical* 18∕25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: The Spamicide module protects Drupal forms with a form field that is hidden from normal users, but visible to spam bots. The module doesn't require appropriate permissions for administrative pages leading to an Access Bypass. Solution: Install the latest version: * If you use the spamicide module for Drupal 7.x, upgrade to spamicide 7.x-1.3 [3] Also see the Spamicide [4] project page. Reported By: * ms7821 [5] Fixed By: * Szczepan Musial [6] * ms7821 [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/spamicide [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/spamicide/releases/7.x-1.3 [4] https://www.drupal.org/project/spamicide [5] https://www.drupal.org/user/3637029 [6] https://www.drupal.org/user/2870321 [7] https://www.drupal.org/user/3637029 [8] https://www.drupal.org/user/36762

1 0

Svg Image - Critical - Cross site scripting - SA-CONTRIB-2020-008
by security-news＠drupal.org 25 Mar '20

25 Mar '20

View online: https://www.drupal.org/sa-contrib-2020-008 Project: Svg Image [1] Date: 2020-March-25 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Cross site scripting Description: SVG Image module allows to upload SVG files. The module did not sufficiently protect against malicious code inside SVG files leading to a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have permission to upload an SVG file. Solution: Install the latest version: * If you use the SVG Image module for Drupal 8.x, upgrade to Svg Image 8.x-1.10 [3] Also see the Svg Image [4] project page. Reported By: * Dmitry Kiselev [5] Fixed By: * Yaroslav Lushnikov [6] * Dmitry Kiselev [7] * Jeroen Tubex [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/svg_image [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/svg_image/releases/8.x-1.10 [4] https://www.drupal.org/project/svg_image [5] https://www.drupal.org/user/1945174 [6] https://www.drupal.org/user/2870933 [7] https://www.drupal.org/user/1945174 [8] https://www.drupal.org/user/2228934 [9] https://www.drupal.org/user/36762

1 0

CKEditor - WYSIWYG HTML editor - Moderately critical - Cross site scripting - SA-CONTRIB-2020-007
by security-news＠drupal.org 18 Mar '20

18 Mar '20

View online: https://www.drupal.org/sa-contrib-2020-007 Project: CKEditor - WYSIWYG HTML editor [1] Date: 2020-March-18 Security risk: *Moderately critical* 11∕25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross site scripting Description: The CKEditor module (and its predecessor, FCKeditor module) allows Drupal to replace textarea fields with CKEditor 3.x/4.x (FCKeditor 2.x in case of FCKeditor module) - a visual HTML editor, sometimes called WYSIWYG editor. Due to the usage of the JavaScript `eval()` function on non-filtered data in admin section, it was possible for a user with permission to create content visible in the admin area to inject specially crafted malicious script which causes Cross Site Scripting (XSS). The problem existed in CKEditor module for Drupal, not in JavaScript libraries with the same names. Solution: Install the latest version: * If you use the CKEditor module for Drupal 7.x, upgrade to CKEditor 7.x-1.19 [3] Also see the CKEditor- WYSIWYG HTML editor [4] project page Reported By: * Yonatan Offek [5] Fixed By: * Robert Mikołajuk [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team [1] https://www.drupal.org/project/ckeditor [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ckeditor/releases/7.x-1.19 [4] https://www.drupal.org/project/ckeditor [5] https://www.drupal.org/user/194009 [6] https://www.drupal.org/user/2793801 [7] https://www.drupal.org/user/36762

1 0

Drupal core - Moderately critical - Third-party library - SA-CORE-2020-001
by security-news＠drupal.org 18 Mar '20

18 Mar '20

View online: https://www.drupal.org/sa-core-2020-001 Project: Drupal core [1] Version: 8.8.x-dev8.7.x-dev Date: 2020-March-18 Security risk: *Moderately critical* 13∕25 AC:Complex/A:User/CI:Some/II:Some/E:Proof/TD:Default [2] Vulnerability: Third-party library Description: The Drupal project uses the third-party library CKEditor [3], which has released a security improvement [4] that is needed to protect some Drupal configurations. Vulnerabilities are possible if Drupal is configured to use the WYSIWYG CKEditor for your site’s users. When multiple people can edit content, the vulnerability can be used to execute XSS attacks against other people, including site admins with more access. The latest versions of Drupal update CKEditor to 4.14 to mitigate the vulnerabilities. Solution: Install the latest version: * If you are using Drupal 8.8.x, upgrade to Drupal 8.8.4 [5]. * If you are using Drupal 8.7.x, upgrade to Drupal 8.7.12 [6]. Versions of Drupal 8 prior to 8.7.x have reached end-of-life and do not receive security coverage. The CKEditor module can also be disabled to mitigate the vulnerability until the site is updated. .... Note for Drupal 7 users Drupal 7 core is not affected by this release; however, users who have installed the third-party CKEditor library (for example, with a contributed module) should ensure that the downloaded library is updated to CKEditor 4.14 or higher, or that CDN URLs point to a version of CKEditor 4.14 or higher. Disabling all WYSIWYG modules can mitigate the vulnerability until the site is updated. [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://github.com/ckeditor/ckeditor4 [4] https://ckeditor.com/blog/CKEditor-4.14-with-Paste-from-LibreOffice-release… [5] https://www.drupal.org/project/drupal/releases/8.8.4 [6] https://www.drupal.org/project/drupal/releases/8.7.12

1 0

SAML Service Provider - Critical - Access bypass - SA-CONTRIB-2020-006
by security-news＠drupal.org 11 Mar '20

11 Mar '20

View online: https://www.drupal.org/sa-contrib-2020-006 Project: SAML Service Provider [1] Date: 2020-March-11 Security risk: *Critical* 15∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Description: This module enables you to authenticate Drupal users using an external SAML Identity Provider. If the site is configured to allow visitors to register for user accounts but administrator approval is required, the module doesn't sufficiently enforce the administrative approval requirement, in the case where the requesting user has already authenticated through SAML. This vulnerability is mitigated by the fact that user accounts created in this way have only default roles, which may not have access significantly beyond that of an anonymous user. To mitigate the vulnerability without upgrading sites could disable public registration. Solution: Install the latest version: * If you use the SAML Service Provider module for Drupal 8.x, upgrade to SAML Service Provider 8.x-3.7 [3] Also see the SAML Service Provider [4] project page. Reported By: * J Proctor [5] Fixed By: * J Proctor [6] * James Glasgow [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/saml_sp [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/saml_sp/releases/8.x-3.7 [4] https://www.drupal.org/project/saml_sp [5] https://www.drupal.org/user/1194192 [6] https://www.drupal.org/user/1194192 [7] https://www.drupal.org/user/36590 [8] https://www.drupal.org/user/36762

1 0

SVG Formatter - Critical - Cross site scripting - SA-CONTRIB-2020-005
by security-news＠drupal.org 04 Mar '20

04 Mar '20

View online: https://www.drupal.org/sa-contrib-2020-005 Project: SVG Formatter [1] Date: 2020-March-04 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Cross site scripting Description: SVG Formatter module provides support for using SVG images on your website. This security release fixes third-party dependencies included in or required by SVG Formatter. XSS bypass using entities and tab [3]. This vulnerability is mitigated by the fact that an attacker must be able to upload SVG files. Solution: Install the latest version: * If you use the SVG Formatter module for Drupal 8.x, upgrade to SVG Formatter 8.x-1.12 [4] Also see the SVG Formatter [5] project page. Reported By: * Jeroen Tubex [6] Fixed By: * Goran Nikolovski [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/svg_formatter [2] https://www.drupal.org/security-team/risk-levels [3] https://github.com/darylldoyle/svg-sanitizer/issues/31 [4] https://www.drupal.org/project/svg_formatter/releases/8.x-1.12 [5] https://www.drupal.org/project/svg_formatter [6] https://www.drupal.org/user/2228934 [7] https://www.drupal.org/user/3451979 [8] https://www.drupal.org/user/36762

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news