Security-news

security-news@drupal.org

1 participants
1782 discussions

Profile - Moderately critical - Access Bypass - SA-CONTRIB-2020-004
by security-news＠drupal.org 19 Feb '20

19 Feb '20

View online: https://www.drupal.org/sa-contrib-2020-004 Project: Profile [1] Date: 2020-February-19 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access Bypass Description: The Profile module enables you to allow users to have configurable user profiles. The module doesn't sufficiently check access when creating a user profile. Users with the "create profiles" permission could create profiles for any users. Solution: Install the latest version: * If you use the Profile module for Drupal 8.x, upgrade to Profile 8.x-1.1 [3] Also see the Profile [4] project page. Reported By: * karl972 [5] Fixed By: * Matt Glaman [6] * Bojan Živanović [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/profile [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/profile/releases/8.x-1.1 [4] https://www.drupal.org/project/profile [5] https://www.drupal.org/user/1541584 [6] https://www.drupal.org/user/2416470 [7] https://www.drupal.org/user/86106 [8] https://www.drupal.org/user/36762

1 0

Views Bulk Operations (VBO) - Moderately critical - Access bypass - SA-CONTRIB-2020-003
by security-news＠drupal.org 05 Feb '20

05 Feb '20

View online: https://www.drupal.org/sa-contrib-2020-003 Project: Views Bulk Operations (VBO) [1] Date: 2020-February-05 Security risk: *Moderately critical* 12∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Description: Views Bulk Operations provides enhancements to running bulk actions on views. The module contains an access bypass vulnerability that might allow users to execute views actions that they should not have access to. This vulnerability is mitigated by the fact that it only occurs in the case of customised action access (by means of hook_action_info_alter). Solution: Install the latest version: * If you use Views Bulk Operations version 3.x for Drupal 8.x, upgrade to Views Bulk Operations 8.x-3.4 [3] * If you use Views Bulk Operations version 2.x for Drupal 8.x, upgrade to Views Bulk Operations 8.x-2.6 [4] Also see the Views Bulk Operations (VBO) [5] project page. Reported By: * Adam Shepherd [6] Fixed By: * Adam Shepherd [7] * Marcin Grabias [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/views_bulk_operations [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/views_bulk_operations/releases/8.x-3.4 [4] https://www.drupal.org/project/views_bulk_operations/releases/8.x-2.6 [5] https://www.drupal.org/project/views_bulk_operations [6] https://www.drupal.org/user/2650563 [7] https://www.drupal.org/user/2650563 [8] https://www.drupal.org/user/1599440 [9] https://www.drupal.org/user/36762

1 0

SpamSpan filter - Moderately critical - Cross site scripting - SA-CONTRIB-2020-002
by security-news＠drupal.org 22 Jan '20

22 Jan '20

View online: https://www.drupal.org/sa-contrib-2020-002 Project: SpamSpan filter [1] Date: 2020-January-22 Security risk: *Moderately critical* 11∕25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross site scripting Description: The SpamSpan module obfuscates email addresses to help prevent spambots from collecting them. This module contains a spamspan twig filter which doesn't sanitize the passed HTML string. This vulnerability is mitigated by the fact that sites must have custom twig template files that use the SpamSpan filter on a field that an attacker could populate. By default the SpamSpan module does not use the vulnerable twig filter. Solution: Install the latest version: * If you use the SpamSpan module for Drupal 8.x, upgrade to SpamSpan 8.x-1.1 [3] Also see the SpamSpan filter [4] project page. Reported By: * Jeroen Tubex [5] Fixed By: * Jeroen Tubex [6] * vitalie [7] Coordinated By: * Ben Jeavons [8] of the Drupal Security Team [1] https://www.drupal.org/project/spamspan [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/spamspan/releases/8.x-1.1 [4] https://www.drupal.org/project/spamspan [5] https://www.drupal.org/user/2228934 [6] https://www.drupal.org/user/2228934 [7] https://www.drupal.org/user/175134 [8] https://www.drupal.org/u/coltrane

1 0

Radix - Moderately critical - Cross site scripting - SA-CONTRIB-2020-001
by security-news＠drupal.org 15 Jan '20

15 Jan '20

View online: https://www.drupal.org/sa-contrib-2020-001 Project: Radix [1] Date: 2020-January-15 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Description: Radix is a base theme for Drupal, with Bootstrap 4, Sass, ES6 and BrowserSync built-in. The module doesn't sufficiently filter menu titles when used in a dropdown in the main menu. This vulnerability is mitigated by the fact that an attacker must have permission to edit a menu title used in the main menu. Solution: Install the latest version: * If you use the Radix theme for Drupal 7.x, upgrade to Radix 7.x-3.8 [3] Also see the Radix [4] project page. Reported By: * annagaz [5] Fixed By: * David Snopek [6] of the Drupal Security Team Coordinated By: * David Snopek [7] of the Drupal Security Team [1] https://www.drupal.org/project/radix [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/radix/releases/7.x-3.8 [4] https://www.drupal.org/project/radix [5] https://www.drupal.org/user/2741499 [6] https://www.drupal.org/user/266527 [7] https://www.drupal.org/user/266527

1 0

Drupal core - Moderately critical - Multiple vulnerabilities - SA-CORE-2019-010
by security-news＠drupal.org 18 Dec '19

18 Dec '19

View online: https://www.drupal.org/sa-core-2019-010 Project: Drupal core [1] Version: 8.8.x-dev8.7.x-dev Date: 2019-December-18 Security risk: *Moderately critical* 14∕25 AC:Basic/A:Admin/CI:Some/II:All/E:Theoretical/TD:Default [2] Vulnerability: Multiple vulnerabilities Description: Drupal 8 core's file_save_upload() function does not strip the leading and trailing dot ('.') from filenames, like Drupal 7 did. Users with the ability to upload files with any extension in conjunction with contributed modules may be able to use this to upload system files such as .htaccess in order to bypass protections afforded by Drupal's default .htaccess file. After this fix, file_save_upload() now trims leading and trailing dots from filenames. Solution: Install the latest version: * If you use Drupal core 8.7.x: 8.7.11 [3] * If you use Drupal core 8.8.x: 8.8.1 [4] Versions of Drupal 8 prior to 8.7.x are end-of-life and do not receive security coverage. Reported By: * Rohit Kapur [5] * Filipe Reis [6] * Dan Reif [7] * mramydnei [8] Fixed By: * Lee Rowlands [9] of the Drupal Security Team * Greg Knaddison [10] of the Drupal Security Team * Michael Hess [11] of the Drupal Security Team * Kim Pepper [12] * Alex Pott [13] of the Drupal Security Team * Derek Wright [14] * Jess [15] of the Drupal Security Team * David Rothstein [16] of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/drupal/releases/8.7.11 [4] https://www.drupal.org/project/drupal/releases/8.8.1 [5] https://www.drupal.org/user/3623849 [6] https://www.drupal.org/user/3521501 [7] https://www.drupal.org/user/454444 [8] https://www.drupal.org/user/3529990 [9] https://www.drupal.org/user/395439 [10] https://www.drupal.org/user/36762 [11] https://www.drupal.org/user/102818 [12] https://www.drupal.org/user/370574 [13] https://www.drupal.org/user/157725 [14] https://www.drupal.org/user/46549 [15] https://www.drupal.org/user/65776 [16] https://www.drupal.org/user/124982

1 0

Drupal core - Critical - Multiple vulnerabilities - SA-CORE-2019-012
by security-news＠drupal.org 18 Dec '19

18 Dec '19

View online: https://www.drupal.org/sa-core-2019-012 Project: Drupal core [1] Version: 8.8.x-dev8.7.x-dev7.x-dev Date: 2019-December-18 Security risk: *Critical* 17∕25 AC:Basic/A:User/CI:All/II:All/E:Proof/TD:Uncommon [2] Vulnerability: Multiple vulnerabilities Description: The Drupal project uses the third-party library Archive_Tar [3], which has released a security update that impacts some Drupal configurations. Multiple vulnerabilities are possible if Drupal is configured to allow .tar, .tar.gz, .bz2 or .tlz file uploads and processes them. The latest versions of Drupal update Archive_Tar to 1.4.9 to mitigate the file processing vulnerabilities. Solution: Install the latest version: * If you are using Drupal 7.x, upgrade to Drupal 7.69 [4]. * If you are using Drupal 8.7.x, upgrade to Drupal 8.7.11 [5]. * If you are using Drupal 8.8.x, upgrade to Drupal 8.8.1 [6]. Versions of Drupal 8 prior to 8.7.x are end-of-life and do not receive security coverage. Reported By: * Jasper Mattsson [7] Fixed By: * Lee Rowlands [8] of the Drupal Security Team * Peter Wolanin [9] of the Drupal Security Team * Sam Becker [10] * Jasper Mattsson [11] * David Rothstein [12] of the Drupal Security Team * michieltcs [13] * Ayesh Karunaratne [14] * Alex Pott [15] of the Drupal Security Team * Jess [16] of the Drupal Security Team * Samuel Mortenson [17] of the Drupal Security Team * Vijaya Chandran Mani [18] * Drew Webber [19] of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://pear.php.net/package/Archive_Tar/ [4] https://www.drupal.org/project/drupal/releases/7.69 [5] https://www.drupal.org/project/drupal/releases/8.7.11 [6] https://www.drupal.org/project/drupal/releases/8.8.1 [7] https://www.drupal.org/user/521118 [8] https://www.drupal.org/user/395439 [9] https://www.drupal.org/user/49851 [10] https://www.drupal.org/user/1485048 [11] https://www.drupal.org/user/521118 [12] https://www.drupal.org/user/124982 [13] https://www.drupal.org/user/3587972 [14] https://www.drupal.org/user/796148 [15] https://www.drupal.org/user/157725 [16] https://www.drupal.org/user/65776 [17] https://www.drupal.org/user/2582268 [18] https://www.drupal.org/user/93488 [19] https://www.drupal.org/user/255969

1 0

Drupal core - Moderately critical - Access bypass - SA-CORE-2019-011
by security-news＠drupal.org 18 Dec '19

18 Dec '19

View online: https://www.drupal.org/sa-core-2019-011 Project: Drupal core [1] Version: 8.8.x-dev8.7.x-dev Date: 2019-December-18 Security risk: *Moderately critical* 10∕25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Description: The Media Library module has a security vulnerability whereby it doesn't sufficiently restrict access to media items in certain configurations. Solution: * If you are using Drupal 8.7.x, you should upgrade to Drupal 8.7.11 [3]. * If you are using Drupal 8.8.x, you should upgrade to Drupal 8.8.1 [4]. Versions of Drupal 8 prior to 8.7.x are end-of-life and do not receive security coverage. Alternatively, you may mitigate this vulnerability by unchecking the "Enable advanced UI" checkbox on /admin/config/media/media-library. (This mitigation is not available in 8.7.x.) Reported By: * Adam G-H [5] Fixed By: * Adam G-H [6] * Jess [7] of the Drupal Security Team * Andrei Mateescu [8] * Greg Knaddison [9] of the Drupal Security Team * Alex Bronstein [10] of the Drupal Security Team * Sean Blommaert [11] * Lee Rowlands [12] of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://security.drupal.org/project/drupal/releases/8.7.11 [4] https://security.drupal.org/project/drupal/releases/8.8.1 [5] https://www.drupal.org/user/205645 [6] https://www.drupal.org/user/205645 [7] https://www.drupal.org/user/65776 [8] https://www.drupal.org/user/729614 [9] https://www.drupal.org/user/36762 [10] https://www.drupal.org/user/78040 [11] https://www.drupal.org/user/545912 [12] https://www.drupal.org/user/395439

1 0

Drupal core - Moderately critical - Denial of Service - SA-CORE-2019-009
by security-news＠drupal.org 18 Dec '19

18 Dec '19

View online: https://www.drupal.org/sa-core-2019-009 Project: Drupal core [1] Version: 8.8.x-dev8.7.x-dev Date: 2019-December-18 Security risk: *Moderately critical* 12∕25 AC:None/A:None/CI:None/II:None/E:Theoretical/TD:All [2] Vulnerability: Denial of Service Description: A visit to install.php can cause cached data to become corrupted. This could cause a site to be impaired until caches are rebuilt. Solution: Install the latest version: * If you are using Drupal 8.7.x, upgrade to Drupal 8.7.11 [3]. * If you are using Drupal 8.8.x, upgrade to Drupal 8.8.1 [4]. Versions of Drupal 8 prior to 8.7.x are end-of-life and do not receive security coverage. To mitigate this issue in any version of Drupal 8, you can also block access to install.php if it's not required. Reported By: * Drew Webber [5] of the Drupal Security Team Fixed By: * Drew Webber [6] of the Drupal Security Team * Lee Rowlands [7] of the Drupal Security Team * Heine [8] of the Drupal Security Team * Alex Pott [9] of the Drupal Security Team * Jess [10] of the Drupal Security Team * Damien McKenna [11] of the Drupal Security Team * David Snopek [12] of the Drupal Security Team * Nathaniel Catchpole [13] of the Drupal Security Team * Greg Knaddison [14] of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/drupal/releases/8.7.11 [4] https://www.drupal.org/project/drupal/releases/8.8.1 [5] https://www.drupal.org/user/255969 [6] https://www.drupal.org/user/255969 [7] https://www.drupal.org/user/395439 [8] https://www.drupal.org/user/17943 [9] https://www.drupal.org/user/157725 [10] https://www.drupal.org/user/65776 [11] https://www.drupal.org/user/108450 [12] https://www.drupal.org/user/266527 [13] https://www.drupal.org/user/35733 [14] https://www.drupal.org/user/36762

1 0

Modal Page - Moderately critical - Access bypass - SA-CONTRIB-2019-094
by security-news＠drupal.org 11 Dec '19

11 Dec '19

View online: https://www.drupal.org/sa-contrib-2019-094 Project: Modal Page [1] Version: 8.x-2.48.x-2.38.x-2.28.x-2.18.x-2.0 Date: 2019-December-11 Security risk: *Moderately critical* 10∕25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Description: This project enables administrators to create modal dialogs. The routes used by the module lacked proper permissions, allowing untrusted users to access, create and modify modal configurations. Solution: * If you use the Modal Page module 8.x-2.x, upgrade to 8.x-2.5 [3] * Review user permissions after updating to ensure only trusted users have access to manage modals. Reported By: * Will Mowlam [4] Fixed By: * Renato Gonçalves H [5] * Thalles Ferreira [6] Coordinated By: * Damien McKenna [7] of the Drupal Security Team [1] https://www.drupal.org/project/modal_page [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/modal_page/releases/8.x-2.5 [4] https://www.drupal.org/user/232558 [5] https://www.drupal.org/user/3326031 [6] https://www.drupal.org/user/3589086 [7] https://www.drupal.org/u/damienmckenna

1 0

Taxonomy access fix - Moderately critical - Access bypass - SA-CONTRIB-2019-093
by security-news＠drupal.org 11 Dec '19

11 Dec '19

View online: https://www.drupal.org/sa-contrib-2019-093 Project: Taxonomy access fix [1] Version: 8.x-2.68.x-2.58.x-2.4 Date: 2019-December-11 Security risk: *Moderately critical* 13∕25 AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: This module extends access handling of Drupal Core's Taxonomy module. The module doesn't sufficiently check, * if a given entity should be access controlled, defaulting to allowing access even to unpublished Taxonomy Terms. * if certain administrative routes should be access controlled, defaulting to allowing access even to users without permission to access these administrative routes. The vulnerability is mitigated by the facts, that * the user interface to change the status of Taxonomy Terms has been released in Drupal Core 8.8 and a custom or contributed module is required in earlier versions of Drupal Core to mark Taxonomy Terms as unpublished. * all entity operations (except the view operation) available on affected administrative routes still require appropriate permissions. * an attacker must have a role with permission to either access content or view a Taxonomy Term in a vocabulary. Solution: Install the latest version: * If you use taxonomy_access_fix 8.x-2.4 or later, upgrade to Taxonomy Access Fix 8.x-2.7 [3] Also see the Taxonomy Access Fix project page [4]. Reported By: * guedressel [5] Fixed By: * Julian Pustkuchen [6] * Patrick Fey [7] * Oleh Vehera [8] * guedressel [9] Coordinated By: * Greg Knaddison [10] of the Drupal Security Team * Damien McKenna [11] of the Drupal Security Team [1] https://www.drupal.org/project/taxonomy_access_fix [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/taxonomy_access_fix/releases/8.x-2.7 [4] https://www.drupal.org/project/taxonomy_access_fix [5] https://www.drupal.org/user/266710 [6] https://www.drupal.org/user/291091 [7] https://www.drupal.org/user/998680 [8] https://www.drupal.org/user/3260314 [9] https://www.drupal.org/user/266710 [10] https://www.drupal.org/u/greggles [11] https://www.drupal.org/u/damienmckenna

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news