Security-news

security-news@drupal.org

1 participants
1782 discussions

Imagecache External - Critical - Insecure session token management - SA-CONTRIB-2019-065
by security-news＠drupal.org 21 Aug '19

21 Aug '19

View online: https://www.drupal.org/sa-contrib-2019-065 Project: Imagecache External [1] Date: 2019-August-21 Security risk: *Critical* 15∕25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Insecure session token management Description: This module that allows you to store external images on your server and apply your own Image Styles. The module exposes cookies to external sites when making external image requests. This vulnerability is mitigated by using the whitelisted host feature to restrict external image requests from trusted sources. Solution: Install the latest version: * If you use the Imagecache External 8.x-1.0 version, upgrade to Imagecache External 8.x-1.1 version [3] Also see the Imagecache External [4] project page. Reported By: * Jason Want [5] * Heine Deelstra [6] of the Drupal Security Team Fixed By: * Heine Deelstra [7] of the Drupal Security Team * Baris Wanschers [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/imagecache_external [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/imagecache_external/releases/8.x-1.1 [4] https://www.drupal.org/project/imagecache_external [5] https://www.drupal.org/user/589890 [6] https://www.drupal.org/user/17943 [7] https://www.drupal.org/user/17943 [8] https://www.drupal.org/user/107229 [9] https://www.drupal.org/user/36762

1 0

Forms Steps - Critical - Access bypass - SA-CONTRIB-2019-064
by security-news＠drupal.org 14 Aug '19

14 Aug '19

View online: https://www.drupal.org/sa-contrib-2019-064 Project: Forms Steps [1] Date: 2019-August-14 Security risk: *Critical* 16∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: Forms Steps provides an UI to create form workflows using form modes. It creates quick and configurable multisteps forms. The module doesn't sufficiently check user permissions to access its workflows entities that allows to see any entities that have been created through the different steps of its multistep forms. This vulnerability is mitigated by the fact that you have to know the Forms Steps URL to create a content linked to the flow. Also, all created content is very hard to edit through the same flow as you have to know the URL and the linked hash to the content. Solution: Install the latest version: * If you use the Forms Steps module for Drupal 8.x, upgrade to Forms Steps 8.x-1.2 [3] Also see the Forms Steps [4] project page. Reported By: * solide-echt [5] Fixed By: * Hakim Rachidi [6] * solide-echt [7] * nicoloye [8] Coordinated By: * Michael Hess [9] of the Drupal Security Team * Greg Knaddison [10] of the Drupal Security Team [1] https://www.drupal.org/project/forms_steps [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/forms_steps/releases/8.x-1.2 [4] https://www.drupal.org/project/forms_steps [5] https://www.drupal.org/user/46176 [6] https://www.drupal.org/user/3008327 [7] https://www.drupal.org/user/46176 [8] https://www.drupal.org/user/315225 [9] https://www.drupal.org/user/102818 [10] https://www.drupal.org/user/36762

1 0

External Links Filter - Moderately critical - Open Redirect Vulnerability - SA-CONTRIB-2019-063
by security-news＠drupal.org 14 Aug '19

14 Aug '19

View online: https://www.drupal.org/sa-contrib-2019-063 Project: External Links Filter [1] Date: 2019-August-14 Security risk: *Moderately critical* 10∕25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:All [2] Vulnerability: Open Redirect Vulnerability Description: The External Link Filter module provides an input filter that replaces external links by a local link that redirects to the target URL. The module did not have protection for the Redirect URL to go where content authors intended. Solution: Install the latest version: * If you use the External Links Filter module for Drupal 7.x, upgrade to External Links Filter version 7.x-3.1 [3] * If you use the External Links Filter module for Drupal 8.x, upgrade to External Links Filter version 8.x-1.2 [4] Also see the External Links Filter [5] project page. Reported By: * Manuel Adán [6] Fixed By: * Manuel Adán [7] * Dmitry Drozdik [8] Coordinated By: * Michael Hess [9] of the Drupal Security Team * Greg Knaddison [10] of the Drupal Security Team [1] https://www.drupal.org/project/elf [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/elf/releases/7.x-3.1 [4] https://www.drupal.org/project/elf/releases/8.x-1.2 [5] https://www.drupal.org/project/elf [6] https://www.drupal.org/user/516420 [7] https://www.drupal.org/user/516420 [8] https://www.drupal.org/user/574124 [9] https://www.drupal.org/user/102818 [10] https://www.drupal.org/user/36762

1 0

Super Login - Moderately critical - Cross site scripting - SA-CONTRIB-2019-062
by security-news＠drupal.org 14 Aug '19

14 Aug '19

View online: https://www.drupal.org/sa-contrib-2019-062 Project: Super Login [1] Date: 2019-August-14 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Description: This module improves the Drupal login page with the new features and layout. The module doesn't sufficiently filter input text in the administration pages text configuration inputs. For example, the login text field. The vulnerability is mitigated by the fact it can only be exploited by a user with the "Administer super login" permission. Solution: Install the latest version: * If you use the Super Login module for Drupal 8.x, upgrade to Super Login 8.x-1.3 [3] * If you use the Super Login module for Drupal 7.x, upgrade to Super Login 7.x-1.4 [4] Also see the Super Login [5] project page. Reported By: * Mitch Portier [6] Fixed By: * Mitch Portier [7] * Shawn Ostermann [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/super_login [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/super_login/releases/8.x-1.3 [4] https://www.drupal.org/project/super_login/releases/7.x-1.4 [5] https://www.drupal.org/project/super_login [6] https://www.drupal.org/user/2284182 [7] https://www.drupal.org/user/2284182 [8] https://www.drupal.org/user/61221 [9] https://www.drupal.org/user/36762

1 0

scroll to top - Moderately critical - Cross site scripting - SA-CONTRIB-2019-061
by security-news＠drupal.org 14 Aug '19

14 Aug '19

View online: https://www.drupal.org/sa-contrib-2019-061 Project: scroll to top [1] Date: 2019-August-14 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Description: The Scroll To Top module enables you to have an animated scroll to top link in the bottom of the node. The module does not sufficiently filter configuration text leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer scroll to top". Solution: Install the latest version of the module. * If you use the Scroll To Top module for Drupal 7.x, upgrade to Scroll To Top 7.x-2.2 [3] Also see the scroll to top [4] project page. Reported By: * Ayesh Karunaratne [5] * Yonatan Offek [6] Fixed By: * Ayesh Karunaratne [7] * Tarek Djebali [8] Coordinated By: * Michael Hess [9] of the Drupal Security Team * Greg Knaddison [10] of the Drupal Security Team [1] https://www.drupal.org/project/scroll_to_top [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/scroll_to_top/releases/7.x-2.2 [4] https://www.drupal.org/project/scroll_to_top [5] https://www.drupal.org/user/796148 [6] https://www.drupal.org/user/194009 [7] https://www.drupal.org/user/796148 [8] https://www.drupal.org/user/745218 [9] https://www.drupal.org/user/102818 [10] https://www.drupal.org/user/36762

1 0

Existing Values Autocomplete Widget - Critical - Access bypass - SA-CONTRIB-2019-060
by security-news＠drupal.org 24 Jul '19

24 Jul '19

View online: https://www.drupal.org/sa-contrib-2019-060 Project: Existing Values Autocomplete Widget [1] Date: 2019-July-24 Security risk: *Critical* 17∕25 AC:None/A:None/CI:All/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: This module provides an autocomplete widget for text fields that suggests all existing (previously entered) values for that field. The module doesn't sufficiently check for proper access permission before returning autocomplete results. This vulnerability is mitigated by the fact that an attacker must know the route to the autocomplete callback controller though this is easily known. Solution: Install the latest version: * If you use the Existing Values Autocomplete Widget module for Drupal 8.x, upgrade to Existing Values Autocomplete Widget 8.x-1.2 [3] Also see the Existing Values Autocomplete Widget [4] project page. Reported By: * David Stinemetze [5] Fixed By: * Art Williams [6] Coordinated By: * Michael Hess [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/existing_values_autocomplete_widget [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/3069768 [4] https://www.drupal.org/project/existing_values_autocomplete_widget [5] https://www.drupal.org/user/2508346 [6] https://www.drupal.org/user/77599 [7] https://www.drupal.org/user/102818 [8] https://www.drupal.org/user/36762

1 0

Facebook Messenger Customer Chat Plugin - Critical - Access bypass - SA-CONTRIB-2019-059
by security-news＠drupal.org 24 Jul '19

24 Jul '19

View online: https://www.drupal.org/sa-contrib-2019-059 Project: Facebook Messenger Customer Chat Plugin [1] Date: 2019-July-24 Security risk: *Critical* 16∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: The Facebook Messenger Customer Chat Plugin module enables you to add the Facebook Messenger Customer Chat Plugin to your Drupal site. The module doesn't require user permissions on the admin page. Solution: Install the latest version: * If you use the Facebook Messenger Customer Chat Plugin module for Drupal 7.x, upgrade to Facebook Messenger Customer Chat Plugin 7.x-1.1 [3] Also see the Facebook Messenger Customer Chat Plugin [4] project page. Reported By: -------- REPORTED BY --------------------------------------------------------- * Marcelo Vani [5] Fixed By: * Marcelo Vani [6] Coordinated By: * Michael Hess [7] of the Drupal Security Team * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/fb_messenger_customer_chat_plugin [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/fb_messenger_customer_chat_plugin/releases/7… [4] https://www.drupal.org/project/fb_messenger_customer_chat_plugin [5] https://www.drupal.org/user/854220 [6] https://www.drupal.org/user/854220 [7] https://www.drupal.org/user/102818 [8] https://www.drupal.org/user/36762

1 0

Metatag - Moderately critical - Information disclosure - SA-CONTRIB-2019-058
by security-news＠drupal.org 24 Jul '19

24 Jul '19

View online: https://www.drupal.org/sa-contrib-2019-058 Project: Metatag [1] Date: 2019-July-24 Security risk: *Moderately critical* 13∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Information disclosure Description: This module enables you to customize meta tags to help with a site's search engine ranking and improve the display of page summaries when shared on social networks. The module doesn't sufficiently check for a site being in maintenance mode. This vulnerability is mitigated by the fact that the site must be configured to disallow access to certain content, and must be put into maintenance mode. Solution: Install the latest version: * If you use the Metatag module for Drupal 8.x, upgrade to Metatag 8.x-1.9 [3] Also see the Metatag [4] project page. Reported By: * Shloma [5] Fixed By: * Damien McKenna [6] of the Drupal Security Team Coordinated By: * Damien McKenna [7] of the Drupal Security Team [1] https://www.drupal.org/project/metatag [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/metatag/releases/8.x-1.9 [4] https://www.drupal.org/project/metatag [5] https://www.drupal.org/user/2858019 [6] https://www.drupal.org/user/108450 [7] https://www.drupal.org/u/damienmckenna

1 0

Drupal core - Critical - Access bypass - SA-CORE-2019-008
by security-news＠drupal.org 17 Jul '19

17 Jul '19

View online: https://www.drupal.org/sa-core-2019-008 Project: Drupal core [1] Date: 2019-July-17 Security risk: *Critical* 17∕25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass CVE IDs: CVE-2019-6342 Description: In Drupal 8.7.4, when the experimental [3] Workspaces module is enabled, an access bypass condition is created. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4. Drupal 8.7.3 and earlier, Drupal 8.6.x and earlier, and Drupal 7.x are *not* affected. Solution: If the site is running Drupal 8.7.4, upgrade to Drupal 8.7.5. *Note, manual step needed.* For sites with the Workspaces module enabled, update.php needs to run to ensure a required cache clear. If there is a reverse proxy cache or content delivery network (e.g. Varnish, CloudFlare) it is also advisable to clear these as well. Reported By: * Dave Botsch [4] Fixed By: * Michael Hess [5] of the Drupal Security Team * Jess [6] of the Drupal Security Team * Greg Knaddison [7] of the Drupal Security Team * Chris McCafferty [8] of the Drupal Security Team * Neil Drumm [9] of the Drupal Security Team * Alex Pott [10] of the Drupal Security Team * Andrei Mateescu [11] [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/core/experimental#beta [4] https://www.drupal.org/user/3534164 [5] https://www.drupal.org/user/102818 [6] https://www.drupal.org/user/65776 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/1850070 [9] https://www.drupal.org/user/3064 [10] https://www.drupal.org/user/157725 [11] https://www.drupal.org/user/729614

1 0

ImageCache Actions - Critical - Multiple Vulnerabilities - SA-CONTRIB-2019-056
by security-news＠drupal.org 17 Jul '19

17 Jul '19

View online: https://www.drupal.org/sa-contrib-2019-056 Project: ImageCache Actions [1] Date: 2019-July-17 Security risk: *Critical* 17∕25 AC:Basic/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Multiple Vulnerabilities Description: The imagecache actions module defines a number of additional image effects that can be used to create image styles. The "Image styles admin" sub module provides additional functionality to duplicate, export and import image styles. The module uses unserialize() to import image styles into another site where unserialize() is known to have security issues when processing potentially unsafe input. This vulnerability is mitigated by the fact that the "Image styles admin" sub module must be enabled and an attacker must have a role with the permission "'administer image styles'". Furthermore, the import functionality supports PHP code included in image effects as part of an image style, which would run on image derivative generation subject to the PHP module being enabled. This is intended behaviour for the "Image styles admin" sub module, but the user access restrictions should reflect the potential risks involved. The new security release of this module introduces a new "import image styles" permission which is marked as restricted. In order to use the image style import functionality, users will need to have a role which has this new permission in addition to "administer image styles" (which is not marked as restricted). Solution: * If you use the Imagecache Actions module for Drupal 7.x, upgrade to Imagecache Actions 7.x-1.10 [3]. * Image Effects [4], the D8 successor is *not* vulnerable to this exploit. Reported By: * Ruben Hofman [5] Fixed By: * Erwin Derksen [6] * Greg Knaddison [7] of the Drupal Security Team Coordinated By: * Greg Knaddison [8] of the Drupal Security Team * Ivo Van Geertruyen [9] of the Drupal Security Team * Drew Webber [10] of the Drupal Security Team [1] https://www.drupal.org/project/imagecache_actions [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/imagecache_actions/releases/7.x-1.10 [4] https://www.drupal.org/project/image_effects [5] https://www.drupal.org/user/3302721 [6] https://www.drupal.org/user/750928 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/36762 [9] https://www.drupal.org/user/383424 [10] https://www.drupal.org/user/255969

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news