Security-news

security-news@drupal.org

1 participants
1782 discussions

Meta tags quick - Moderately critical - Cross Site Scripting - SA-CONTRIB-2019-057
by security-news＠drupal.org 17 Jul '19

17 Jul '19

View online: https://www.drupal.org/sa-contrib-2019-057 Project: Meta tags quick [1] Date: 2019-July-17 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: Metatags quick is a module that manages meta tags (tags that appear in HTML's head section) as Drupal 7 fields. Administration page of metatags quick does not sanitize the output of blocks that appear on the same page. This allows an attacker to inject malicious JavaScript in block markup. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer blocks". Solution: Install the latest version. If you use the Metatags quick module for Drupal 7.x, upgrade to metatags quick 7.x-2.10. [3] Reported By: * Yonatan Offek [4] Fixed By: * Valery Lourie [5] * Yonatan Offek [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team [1] https://www.drupal.org/project/metatags_quick [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/metatags_quick/releases/7.x-2.10 [4] https://www.drupal.org/user/194009 [5] https://www.drupal.org/user/239562 [6] https://www.drupal.org/user/194009 [7] https://www.drupal.org/user/36762

1 0

Custom Permissions - Critical - Access bypass - SA-CONTRIB-2019-055
by security-news＠drupal.org 10 Jul '19

10 Jul '19

View online: https://www.drupal.org/sa-contrib-2019-055 Project: Custom Permissions [1] Version: 8.x-1.x-dev Date: 2019-July-10 Security risk: *Critical* 16∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: This module enables you to add and manage additional custom permissions through the administration UI. The module doesn't sufficiently check for the proper access permissions to this page. This vulnerability is mitigated by the fact that an attacker must know the route of the Custom Permissions administration form though this is easily known. Solution: Install the latest version: * If you use the Custom Permissions 8.x-1.1 for Drupal 8.x, upgrade to Custom Permissions 8.x-1.2 [3] Also see the Custom Permissions [4] project page. Reported By: * Mohammed Razem [5] Fixed By: * David Valdez [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team [1] https://www.drupal.org/project/config_perms [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/config_perms/releases/8.x-1.2 [4] https://www.drupal.org/project/config_perms [5] https://www.drupal.org/user/255384 [6] https://www.drupal.org/user/992990 [7] https://www.drupal.org/user/36762

1 0

Advanced Forum - Critical - Cross Site Scripting - SA-CONTRIB-2019-054
by security-news＠drupal.org 26 Jun '19

26 Jun '19

View online: https://www.drupal.org/sa-contrib-2019-054 Project: Advanced Forum [1] Version: 7.x-2.x-dev Date: 2019-June-26 Security risk: *Critical* 16∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: Advanced Forum builds on and enhances Drupal's core forum module. When used in combination with other Drupal contributed modules, many of which are automatically used by Advanced Forum, you can achieve much of what stand alone software provides. The module doesn't sufficiently sanitise user input in specific circumstances. It is not possible to disable the vulnerable functionality. This vulnerability is mitigated by the fact that an attacker must have a role with permission to create forum content. Solution: Install the latest version: * If you use the Advanced Forum module for Drupal 7.x, upgrade to Advanced Forum 7.x-2.8 [3] Also see the Advanced Forum [4] project page. Reported By: * Drew Webber [5] of the Drupal Security Team Fixed By: * Drew Webber [6] of the Drupal Security Team * Vijaya Chandran Mani [7] Provisonal Member of the Drupal Security Team Coordinated By: * Drew Webber [8] of the Drupal Security Team [1] https://www.drupal.org/project/advanced_forum [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/advanced_forum/releases/7.x-2.8 [4] https://www.drupal.org/project/advanced_forum [5] https://www.drupal.org/user/255969 [6] https://www.drupal.org/user/255969 [7] https://www.drupal.org/user/93488 [8] https://www.drupal.org/user/255969

1 0

Easy Breadcrumb - Critical - Cross Site Scripting - SA-CONTRIB-2019-053
by security-news＠drupal.org 19 Jun '19

19 Jun '19

View online: https://www.drupal.org/sa-contrib-2019-053 Project: Easy Breadcrumb [1] Version: 7.x-2.x-dev Date: 2019-June-19 Security risk: *Critical* 15∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Scripting Description: This module enables you to use the current URL (path alias) and the current page's title to automatically extract the breadcrumb's segments and its respective links then show them as breadcrumbs on your website. The module doesn't sufficiently sanitise user input in certain circumstances. This vulnerability does not require any permissions but can be mitigated by un-checking the 'Allow HTML tags in breadcrumb text' setting (enabled by default). In some cases browsers' built-in XSS protection may prevent exploitation. Solution: Install the latest version: * If you use the Easy Breadcrumb module for Drupal 7.x, upgrade to Easy Breadcrumb 7.x-2.17 [3] Also see the Easy Breadcrumb [4] project page. Reported By: * Jill Garland [5] * P K [6] Fixed By: * Balazs Janos Tatar [7] Provisional Member of the Drupal Security Team * Drew Webber [8] of the Drupal Security Team Coordinated By: * Drew Webber [9] of the Drupal Security Team [1] https://www.drupal.org/project/easy_breadcrumb [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/easy_breadcrumb/releases/7.x-2.17 [4] https://www.drupal.org/project/easy_breadcrumb [5] https://www.drupal.org/user/3617346 [6] https://www.drupal.org/user/2407432 [7] https://www.drupal.org/user/649590 [8] https://www.drupal.org/user/255969 [9] https://www.drupal.org/user/255969

1 0

Universally Unique IDentifier - Moderately critical - Access bypass - SA-CONTRIB-2019-052
by security-news＠drupal.org 29 May '19

29 May '19

View online: https://www.drupal.org/sa-contrib-2019-052 Project: Universally Unique IDentifier [1] Date: 2019-May-29 Security risk: *Moderately critical* 14∕25 AC:Complex/A:User/CI:All/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Description: This module provides an API for adding universally unique identifiers (UUID) to Drupal objects, most notably entities. The module has a privilege escalation vulnerability when it's used in combination with Services+REST server. This vulnerability is mitigated by the fact that an attacker must authenticate to the site, services module must be configured on the site and the user update resource enabled. Solution: Install the latest version: * If you use the Universally Unique IDentifier module for Drupal 7.x, upgrade to UUID 7.x-1.3 [3] Also see the Universally Unique IDentifier [4] project page. Reported By: * Gustavo Iñiguez Goia [5] Fixed By: * Manuel Garcia [6] * Samuel Mortenson [7] of the Drupal Security Team Coordinated By: * Samuel Mortenson [8] of the Drupal Security Team [1] https://www.drupal.org/project/uuid [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/uuid/releases/7.x-1.3 [4] https://www.drupal.org/project/uuid [5] https://www.drupal.org/user/3419891 [6] https://www.drupal.org/user/213194 [7] https://www.drupal.org/user/2582268 [8] https://www.drupal.org/user/2582268

1 0

TableField - Moderately critical - Access bypass and Cross Site Scripting - SA-CONTRIB-2019-051
by security-news＠drupal.org 29 May '19

29 May '19

View online: https://www.drupal.org/sa-contrib-2019-051 Project: TableField [1] Version: 7.x-3.x-dev7.x-2.x-dev Date: 2019-May-29 Security risk: *Moderately critical* 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass and Cross Site Scripting Description: This module allows you to attach tabular data to an entity. *Access bypass* There's no access check for users with an "Export Tablefield Data as CSV". They can export data from unpublished nodes or otherwise inaccessible entities. This vulnerability is mitigated by the fact that an attacker must have a role with the permission 'Export Tablefield Data as CSV'. *XSS* When "Raw data (JSON or XML)" is used in the field's Display settings, it doesn't sanitize JSON output before passing it on to be rendered. This vulnerability is mitigated by the fact that an attacker must have a role with Edit permissions. Solution: Install the latest version: * If you use a Tablefield module version 7.x-2.x, upgrade to tablefield 7.x-3.5 [3]. * If you use a Tablefield module version 7.x-3.x, upgrade to tablefield 7.x-2.8 [4]. Also see the TableField [5] project page. Reported By: * Yonatan Offek [6] Fixed By: * Yonatan Offek [7] * Jen Lampton [8] * Martin Postma [9] Coordinated By: * Greg Knaddison [10] of the Drupal Security Team [1] https://www.drupal.org/project/tablefield [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/tablefield/releases/7.x-3.5 [4] https://www.drupal.org/project/tablefield/releases/7.x-2.8 [5] https://www.drupal.org/project/tablefield [6] https://www.drupal.org/user/194009 [7] https://www.drupal.org/user/194009 [8] https://www.drupal.org/user/85586 [9] https://www.drupal.org/user/210402 [10] https://www.drupal.org/user/36762

1 0

Menu Item Extras - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2019-050
by security-news＠drupal.org 22 May '19

22 May '19

View online: https://www.drupal.org/sa-contrib-2019-050 Project: Menu Item Extras [1] Date: 2019-May-22 Security risk: *Moderately critical* 10∕25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Request Forgery Description: This module enables you to handle fields for Custom Menu Links. The module doesn't sufficiently check requests to one of the module controllers if the user has permission 'administer menu'. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create content. Solution: Install the latest version: * If you use the Menu Item Extras module for Drupal 8.x, upgrade to Menu Item Extras 8.x-2.5 [3] Reported By: * Graham Cole [4] Fixed By: * Andriy Khomych [5] * Graham Cole [6] * Mykhailo Gurei [7] * Oleh Vehera [8] Coordinated By: * Michael Hess [9]of the Drupal Security Team [1] https://www.drupal.org/project/menu_item_extras [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/menu_item_extras/releases/8.x-2.5 [4] https://www.drupal.org/user/364457 [5] https://www.drupal.org/user/3287133 [6] https://www.drupal.org/user/364457 [7] https://www.drupal.org/user/2752909 [8] https://www.drupal.org/user/3260314 [9] https://www.drupal.org/u/mlhess

1 0

Workflow - Moderately critical - Cross Site Scripting - SA-CONTRIB-2019-049
by security-news＠drupal.org 22 May '19

22 May '19

View online: https://www.drupal.org/sa-contrib-2019-049 Project: Workflow [1] Date: 2019-May-22 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: The Workflow module enables you to create arbitrary Workflows, and assign them to Entities. The module doesn't sufficiently escape HTML in the field settings leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer nodes" and "administer workflow". Solution: Install the latest version: * If you use the Workflow module for Drupal 7.x, upgrade to Workflow 7.x-2.12 [3] Reported By: * Roberto Mariani [4] Fixed By: * Roberto Mariani [5] * David Snopek [6] of the Drupal Security Team * John Voskuilen [7] * Sarah Hood [8] * Greg Knaddison [9] of the Drupal Security Team Coordinated By: * Michael Hess [10] of the Drupal Security Team [1] https://www.drupal.org/project/workflow [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/workflow/releases/7.x-2.12 [4] https://www.drupal.org/user/1135096 [5] https://www.drupal.org/user/1135096 [6] https://www.drupal.org/user/266527 [7] https://www.drupal.org/user/591042 [8] https://www.drupal.org/user/275249 [9] https://www.drupal.org/user/36762 [10] https://www.drupal.org/u/mlhess

1 0

Multiple Registration - Critical - Access bypass - SA-CONTRIB-2019-048
by security-news＠drupal.org 15 May '19

15 May '19

View online: https://www.drupal.org/sa-contrib-2019-048 Project: Multiple Registration [1] Date: 2019-May-15 Security risk: *Critical* 19∕25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Description: This module enables you to use special routes for user registration with special roles and custom field sets defined for the role. The module doesn't sufficiently check which user roles can be registered under the scenario when the user tries to register the user with the administrator role. This vulnerability is mitigated on sites where account approval is required as the user starts as blocked but still gets the "Administrator" role. Solution: Install the latest version: * If you use the Multiple registration module for Drupal 8.x, upgrade to Multiple registration 8.x-2.8 [3] Reported By: * iswilson [4] Fixed By: * Yaroslav Samoylenko [5] * iswilson [6] * Cash Williams [7] of the Drupal Security Team Coordinated By: * Cash Williams [8] of the Drupal Security Team [1] https://www.drupal.org/project/multiple_registration [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/multiple_registration/releases/8.x-2.8 [4] https://www.drupal.org/user/415095 [5] https://www.drupal.org/user/3554629 [6] https://www.drupal.org/user/415095 [7] https://www.drupal.org/user/421070 [8] https://www.drupal.org/user/421070

1 0

Opigno forum - Less critical - Access bypass - SA-CONTRIB-2019-046
by security-news＠drupal.org 15 May '19

15 May '19

View online: https://www.drupal.org/sa-contrib-2019-046 Project: Opigno forum [1] Date: 2019-May-15 Security risk: *Less critical* 9∕25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Description: In certain circumstances it is possible that certain forum information is available to unprivileged users because the access check is done with node access instead of grants. This vulnerability is mitigated by the fact that the module itself does not disclose information but only if there are listings such as views where the site builder / developer has not taken this into account. Solution: Install the latest version: * If you use the opigno_forum module for Drupal 8.x, upgrade to opigno_forum 8.x-1.2 [3] Also see the Opigno forum [4] project page. Reported By: * Nathaniel Catchpole [5] of the Drupal Security Team Fixed By: * James Aparicio [6] * Nathaniel Catchpole [7] of the Drupal Security Team Coordinated By: * Nathaniel Catchpole [8] of the Drupal Security Team [1] https://www.drupal.org/project/opigno_forum [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/opigno_forum/releases/8.x-1.2 [4] https://www.drupal.org/project/opigno_forum [5] https://www.drupal.org/user/35733 [6] https://www.drupal.org/user/2547544 [7] https://www.drupal.org/user/35733 [8] https://www.drupal.org/user/35733

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news