- Security-news - lists.drupal.org

Nexus Theme - Critical - Unsupported - SA-CONTRIB-2019-078
by security-news＠drupal.org 13 Nov '19

13 Nov '19

View online: https://www.drupal.org/sa-contrib-2019-078 Project: Nexus Theme [1] Date: 2019-November-13 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/nexus [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Frequently Asked Questions - Critical - Unsupported - SA-CONTRIB-2019-077
by security-news＠drupal.org 13 Nov '19

13 Nov '19

View online: https://www.drupal.org/sa-contrib-2019-077 Project: Frequently Asked Questions [1] Date: 2019-November-13 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Unsupported Description: The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported [3] Solution: If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] in full. [1] https://www.drupal.org/project/faq [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466#procedure---own-project---unsupported [4] https://www.drupal.org/node/251466#procedure---own-project---unsupported

1 0

Open Social - Critical - Insecure Session Management - SA-CONTRIB-2019-075
by security-news＠drupal.org 06 Nov '19

06 Nov '19

View online: https://www.drupal.org/sa-contrib-2019-075 Project: Open Social [1] Date: 2019-November-06 Security risk: *Critical* 15∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Insecure Session Management Description: Open Social is a Drupal distribution for online communities. The included social_magic_login module doesn't sufficiently validate magic login URLs for user accounts that do not have a local password, but login via external systems. The lack of validation makes it possible for an adversary to forge valid login URLs and login to such an account. This vulnerability is mitigated by the fact the module social_magic_login needs to be enabled. Solution: Install the latest version: * If you use the Open Social distribution for Drupal 8.x-7.x, upgrade to open social 8.x-7.1 [3] * If you use the Open Social distribution for Drupal 8.x-6.x, upgrade to open social 8.x-6.5 [4] Alternatively, disable the module social_magic_login. Also see the Open Social [5] project page. Reported By: * Heine [6] of the Drupal Security Team Fixed By: * Heine [7] of the Drupal Security Team * Alexander Varwijk [8] * Ronald te Brake [9] * Drew Webber [10] of the Drupal Security Team Coordinated By: * Heine [11] of the Drupal Security Team [1] https://www.drupal.org/project/social [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/social/releases/8.x-7.1 [4] https://www.drupal.org/project/social/releases/8.x-6.5 [5] https://www.drupal.org/project/social [6] https://www.drupal.org/user/17943 [7] https://www.drupal.org/user/17943 [8] https://www.drupal.org/user/1868952 [9] https://www.drupal.org/user/2314038 [10] https://www.drupal.org/user/255969 [11] https://www.drupal.org/user/17943

1 0

Booking and Availability Management Tools for Drupal - Moderately critical - Access Bypass - SA-CONTRIB-2019-074
by security-news＠drupal.org 16 Oct '19

16 Oct '19

View online: https://www.drupal.org/sa-contrib-2019-074 Project: Booking and Availability Management Tools for Drupal [1] Date: 2019-October-16 Security risk: *Moderately critical* 11∕25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access Bypass Description: The Bat module provides a foundation through which a wide range of availability management, reservation and booking use cases can be addressed. The routes used to view events don't sufficiently guard access for non-privileged users. Specifically, a user with the 'View own' permission for bat events can view others' events as well. Solution: Install the latest version: * If you use the bat module for Drupal 8.x, upgrade to bat 8.x-1.2 [3] Also see the Booking and Availability Management Tools for Drupal [4] project page. Reported By: * Jelle Sebreghts [5] Fixed By: * Adrian Rollett [6] * Lee Rowlands [7] of the Drupal Security Team * Jelle Sebreghts [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/bat [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/bat/releases/8.x-1.2 [4] https://www.drupal.org/project/bat [5] https://www.drupal.org/user/829198 [6] https://www.drupal.org/user/253909 [7] https://www.drupal.org/user/395439 [8] https://www.drupal.org/user/829198 [9] https://www.drupal.org/user/36762

1 0

Maxlength - Moderately critical - Cross Site Scripting - SA-CONTRIB-2019-073
by security-news＠drupal.org 09 Oct '19

09 Oct '19

View online: https://www.drupal.org/sa-contrib-2019-073 Project: Maxlength [1] Date: 2019-October-09 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: This module enables you to set a maximum length allowed on text fields and indicate how many characters are left. The module doesn't sufficiently filter strings leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact the malicious script will not be triggered in the browser of UID 1 nor any user with "Bypass maxlength setting". Solution: Install the latest version: * If you use the Maxlength module for Drupal 7.x, upgrade to Maxlength 7.x-3.3 [3] Also see the Maxlength [4] project page. Reported By: * Yonatan Offek [5] Fixed By: * Yonatan Offek [6] * Aron Novak [7] * Daniel Wehner [8] Coordinated By: * Greg Knaddison [9] Drupal Security Team member [1] https://www.drupal.org/project/maxlength [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/maxlength/releases/7.x-3.3 [4] https://www.drupal.org/project/maxlength [5] https://www.drupal.org/user/194009 [6] https://www.drupal.org/user/194009 [7] https://www.drupal.org/user/61864 [8] https://www.drupal.org/user/99340 [9] https://www.drupal.org/user/36762

1 0

Localization update - Moderately critical - Insecure server configuration - SA-CONTRIB-2019-072
by security-news＠drupal.org 02 Oct '19

02 Oct '19

View online: https://www.drupal.org/sa-contrib-2019-072 Project: Localization update [1] Date: 2019-October-02 Security risk: *Moderately critical* 10∕25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Insecure server configuration Description: This module enables you to automatically download and update the site's interface translation by fetching them from localize.drupal.org or any other Localization server. The module doesn't sufficiently protect the directory it stores translation files in. It's conventional for directories which may be writeable to be protected by a .htaccess file to prevent malicious PHP files placed within them being executed by the webserver. This vulnerability is mitigated by the fact that an attacker typically wouldn't be able to place a malicious file in the module's storage directory. Solution: Install the latest version: * If you use the Localization Update module for Drupal 7.x-1.x, upgrade to Localization Update 7.x-1.2 [3] * If you use the Localization Update module for Drupal 7.x-2.x, upgrade to Localization Update 7.x-2.3 [4] Also see the Localization update [5] project page. Reported By: Gisle Hannemyr [6] Fixed By: * Gisle Hannemyr [7] * Erik Stielstra [8] * Gábor Hojtsy [9] Coordinated By: * Damien McKenna [10] of the Drupal Security Team [1] https://www.drupal.org/project/l10n_update [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/l10n_update/releases/7.x-1.2 [4] https://www.drupal.org/project/l10n_update/releases/7.x-2.3 [5] https://www.drupal.org/project/l10n_update [6] https://www.drupal.org/user/409554 [7] https://www.drupal.org/user/409554 [8] https://www.drupal.org/user/73854 [9] https://www.drupal.org/user/4166 [10] https://www.drupal.org/u/dmckenna

1 0

Simple AMP (Accelerated Mobile Pages) - Moderately critical - Access bypass - SA-CONTRIB-2019-071
by security-news＠drupal.org 02 Oct '19

02 Oct '19

View online: https://www.drupal.org/sa-contrib-2019-071 Project: Simple AMP (Accelerated Mobile Pages) [1] Date: 2019-October-02 Security risk: *Moderately critical* 13∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: This module allows display of a site's content in AMP format. The module doesn't sufficiently check access on unpublished or restricted content. Solution: Install the latest version of the module. * If you use the Simple AMP module for Drupal 8.x, upgrade to Simple AMP 8.x-1.16 [3] Also see the Simple AMP (Accelerated Mobile Pages) [4] project page. Reported By: * M. H. [5] Fixed By: * Minnur Yunusov [6] * M. H. [7] Coordinated By: * Damien McKenna [8] of the Drupal Security Team [1] https://www.drupal.org/project/simple_amp [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/simple_amp/releases/8.x-1.16 [4] https://www.drupal.org/project/simple_amp [5] https://www.drupal.org/user/3054025 [6] https://www.drupal.org/user/702026 [7] https://www.drupal.org/user/3054025 [8] https://www.drupal.org/u/damienmckenna

1 0

Ubercart - Moderately critical - Cross site scripting - SA-CONTRIB-2019-070
by security-news＠drupal.org 02 Oct '19

02 Oct '19

View online: https://www.drupal.org/sa-contrib-2019-070 Project: Ubercart [1] Date: 2019-October-02 Security risk: *Moderately critical* 11∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross site scripting Description: The Ubercart module provides a shopping cart and e-commerce features for Drupal. The order module doesn't sufficiently sanitize user input when displayed on an invoice leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "edit orders". Solution: Install the latest version: * If you use the Ubercart module for Drupal 7.x, upgrade to Ubercart 7.x-3.13 [3] Also see the Ubercart [4] project page. Reported By: * Devin Zuczek [5] Fixed By: * Devin Zuczek [6] * Dave Long [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/ubercart [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ubercart/releases/7.x-3.13 [4] https://www.drupal.org/project/ubercart [5] https://www.drupal.org/user/701754 [6] https://www.drupal.org/user/701754 [7] https://www.drupal.org/user/246492 [8] https://www.drupal.org/user/36762

1 0

Gutenberg - Critical - Access bypass - SA-CONTRIB-2019-069
by security-news＠drupal.org 25 Sep '19

25 Sep '19

View online: https://www.drupal.org/sa-contrib-2019-069 Project: Gutenberg [1] Date: 2019-September-25 Security risk: *Critical* 16∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: This module provides a new UI experience for node editing - Gutenberg editor. The routes used by the Gutenberg editor lack proper permissions allowing untrusted users to view and modify some content they should not be able to view or modify. Solution: Install the latest version: * If you use the Gutenberg module 8.x-1.x, upgrade to 8.x-1.8 [3] * For roles other than administrator, the Administer Gutenberg permission must be given to handle media files on the Gutenberg editor. Also see the Gutenberg [4] project page. Reported By: * Marco Fernandes [5] * Greg Knaddison [6] of the Drupal Security Team Fixed By: * Marco Fernandes [7] * Thor Andre Gretland [8] * Mariusz Andrzejewski [9] Coordinated By: * Greg Knaddison [10] of the Drupal Security Team [1] https://www.drupal.org/project/gutenberg [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/gutenberg/releases/8.x-1.8 [4] https://www.drupal.org/project/gutenberg [5] https://www.drupal.org/user/2127558 [6] https://www.drupal.org/user/36762 [7] https://www.drupal.org/user/2127558 [8] https://www.drupal.org/user/223878 [9] https://www.drupal.org/user/3517832 [10] https://www.drupal.org/user/36762

1 0

Permissions by Term - Moderately critical - Access bypass - SA-CONTRIB-2019-068
by security-news＠drupal.org 25 Sep '19

25 Sep '19

View online: https://www.drupal.org/sa-contrib-2019-068 Project: Permissions by Term [1] Version: 8.x-1.x-dev Date: 2019-September-25 Security risk: *Moderately critical* 14∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Description: This module enables you to control access to content based on taxonomy terms. The module doesn't sufficiently check if a given entity should be access controlled, defaulting to allowing access even to unpublished nodes. The vulnerability is mitigated by the fact that the submodule Permissions by Entity must also be enabled. Solution: Install the latest version: * If you use the Permissions by Term module for Drupal 8.x, upgrade to Permissions by Term 8.x-2.11 [3] Also see the Permissions by Term [4] project page. Reported By: * Jimmy Henderickx [5] Fixed By: * Marc-Oliver Teschke [6] Coordinated By: * Heine [7] of the Drupal Security Team * Ivo Van Geertruyen [8] of the Drupal Security Team [1] https://www.drupal.org/project/permissions_by_term [2] https://www.drupal.org/security-team/risk-levels [3] https://drupal.org/project/permissions_by_term/releases/8.x-2.11 [4] https://www.drupal.org/project/permissions_by_term [5] https://www.drupal.org/user/462700 [6] https://www.drupal.org/user/1529744 [7] https://www.drupal.org/u/heine [8] https://www.drupal.org/u/mrbaileys

1 0