Security-news

security-news@drupal.org

1 participants
1782 discussions

Commerce Custom Order Status - Moderately critical - Cross Site Scripting - SA-CONTRIB-2018-046
by security-news＠drupal.org 11 Jul '18

11 Jul '18

View online: https://www.drupal.org/sa-contrib-2018-046 Project: Commerce Custom Order Status [1] Date: 2018-July-11 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: Commerce Custom Order Status provides forms for administrators to add, edit, and delete order statuses from the order settings screen. The module doesn't sufficiently sanitize the output of the status names. This vulnerability is mitigated by the fact that an attacker must have a role with the "configure order settings" permission. Solution: Install the latest version: * If you use the Commerce Custom Order Status module for Drupal 7.x, upgrade to Commerce Custom Order Status 7.x-1.1 [3] Also see the Commerce Custom Order Status [4] project page. Reported By: * bucefal91 [5] Fixed By: * bucefal91 [6] * Fabien Leroux [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/commerce_custom_order_status [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/commerce_custom_order_status/releases/7.x-1.1 [4] https://www.drupal.org/project/commerce_custom_order_status [5] https://www.drupal.org/user/504128 [6] https://www.drupal.org/user/504128 [7] https://www.drupal.org/user/407852 [8] https://www.drupal.org/u/greggles

1 0

Tapestry - Moderately critical - Cross Site Scripting - SA-CONTRIB-2018-051
by security-news＠drupal.org 11 Jul '18

11 Jul '18

View online: https://www.drupal.org/sa-contrib-2018-051 Project: Tapestry [1] Date: 2018-July-11 Security risk: *Moderately critical* 14∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross Site Scripting Description: This theme provides Drupal users with many advanced features including 20 Different Color Styles, 30 User Regions, Custom Block Theme Templates, Suckerfish Menus, Icon Support, Advanced Page Layout Options, Simple Configuration, Custom Typography... The theme doesn't sufficiently sanitize user input. This vulnerability is mitigated by the fact that the theme is only exploitable with non-default settings and under certain site configurations. Solution: Install the latest version: * If you use the Tapestry theme for Drupal 7.x, upgrade to Tapestry 7.x-2.2 [3] Also see the Tapestry [4] project page. Reported By: * Drew Webber [5] Fixed By: * Kisugi Ai [6] Coordinated By: * Michael Hess [7] of the Drupal Security Team [1] https://www.drupal.org/project/tapestry [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/tapestry/releases/7.x-2.2 [4] https://www.drupal.org/project/tapestry [5] https://www.drupal.org/user/255969 [6] https://www.drupal.org/user/1284976 [7] https://www.drupal.org/u/mlhess

1 0

litejazz - Moderately critical - Cross Site Scripting - SA-CONTRIB-2018-050
by security-news＠drupal.org 11 Jul '18

11 Jul '18

View online: https://www.drupal.org/sa-contrib-2018-050 Project: litejazz [1] Date: 2018-July-11 Security risk: *Moderately critical* 14∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross Site Scripting Description: This theme features 3 color styles, 12 fully collapsible regions, suckerfish menus, fluid or fixed widths, easy configuration, and more. The theme doesn't sufficiently sanitize user input. This vulnerability is mitigated by the fact that the theme is only exploitable with non-default settings and under certain site configurations. Solution: Install the latest version: * If you use the litejazz theme for Drupal 7.x, upgrade to litejazz 7.x-2.3 [3] Also see the litejazz [4] project page. Reported By: * Drew Webber [5] Fixed By: * Kisugi Ai [6] Coordinated By: * Michael Hess [7] of the Drupal Security Team [1] https://www.drupal.org/project/litejazz [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/litejazz/releases/7.x-2.3 [4] https://www.drupal.org/project/litejazz [5] https://www.drupal.org/user/255969 [6] https://www.drupal.org/user/1284976 [7] https://www.drupal.org/u/mlhess

1 0

NewsFlash - Moderately critical - Cross Site Scripting - SA-CONTRIB-2018-049
by security-news＠drupal.org 11 Jul '18

11 Jul '18

View online: https://www.drupal.org/sa-contrib-2018-049 Project: NewsFlash [1] Date: 2018-July-11 Security risk: *Moderately critical* 14∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross Site Scripting Description: This theme features 7 color styles, 12 collapsible regions, suckerfish menus, fluid or fixed widths, and lots more. The theme doesn't sufficiently sanitize user input. This vulnerability is mitigated by the fact that the theme is only exploitable with non-default settings and under certain site configurations. Solution: Install the latest version: * If you use the NewsFlash theme for Drupal 7.x, upgrade to NewsFlash 7.x-2.6 [3] Also see the NewsFlash [4] project page. Reported By: * Drew Webber [5] Fixed By: * Kisugi Ai [6] Coordinated By: * Michael Hess [7] of the Drupal Security Team [1] https://www.drupal.org/project/newsflash [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/newsflash/releases/7.x-2.6 [4] https://www.drupal.org/project/newsflash [5] https://www.drupal.org/user/255969 [6] https://www.drupal.org/user/1284976 [7] https://www.drupal.org/u/mlhess

1 0

Beale Street - Moderately critical - Cross Site Scripting - SA-CONTRIB-2018-048
by security-news＠drupal.org 11 Jul '18

11 Jul '18

View online: https://www.drupal.org/sa-contrib-2018-048 Project: Beale Street [1] Date: 2018-July-11 Security risk: *Moderately critical* 13∕25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross Site Scripting Description: This theme features 4 built-in color styles, 18 collapsible regions, Suckerfish menus, flexible widths, adjustable sidebars, configurable font family, and lots more. The theme doesn't sufficiently sanitize user input. This vulnerability is mitigated by the fact that the theme is not exploitable under common site configurations. Solution: * If you use the Beale Street theme for Drupal 7.x, upgrade to Beale Street 7.x-1.2 [3] Also see the Beale Street [4] project page. Reported By: * Drew Webber [5] Fixed By: * Kisugi Ai [6] Coordinated By: * Michael Hess [7] of the Drupal Security Team [1] https://www.drupal.org/project/bealestreet [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/bealestreet/releases/7.x-1.2 [4] https://www.drupal.org/project/bealestreet [5] https://www.drupal.org/user/255969 [6] https://www.drupal.org/user/1284976 [7] https://www.drupal.org/u/mlhess

1 0

EU Cookie Compliance - Moderately critical - Cross Site Scripting - SA-CONTRIB-2018-047
by security-news＠drupal.org 11 Jul '18

11 Jul '18

View online: https://www.drupal.org/sa-contrib-2018-047 Project: EU Cookie Compliance [1] Date: 2018-July-11 Security risk: *Moderately critical* 12∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Scripting Description: This module addresses the General Data Protection Regulation (GDPR) that came into effect 25th May 2018, and the EU Directive on Privacy and Electronic Communications from 2012. It provides a banner where you can gather consent from the user to store cookies on their computer and handle their personal information. This module does not sanitize some inputs leading to XSS. This is mitigated by the attacker having the permission "Administer EU Cookie Compliance." Solution: Install the latest version: * If you use the eu_cookie_compliance module for Drupal 7.x, upgrade to eu_cookie_compliance 7.x-1.24 [3] * If you use the eu_cookie_compliance module for Drupal 8.x, upgrade to eu_cookie_compliance 8.x-1.1 [4] Also see the EU Cookie Compliance [5] project page. Reported By: * Alexander Hass [6] Fixed By: * Sven Berg Ryen [7] Coordinated By: * Michael Hess [8] of the Drupal Security Team [1] https://www.drupal.org/project/eu_cookie_compliance [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/eu_cookie_compliance/releases/7.x-1.24 [4] https://www.drupal.org/project/eu_cookie_compliance/releases/8.x-1.1 [5] https://www.drupal.org/project/eu-cookie-compliance [6] https://www.drupal.org/user/85918 [7] https://www.drupal.org/user/667244 [8] https://www.drupal.org/u/mlhess

1 0

Universally Unique IDentifier - Moderately critical - Arbitrary file upload - SA-CONTRIB-2018-045
by security-news＠drupal.org 04 Jul '18

04 Jul '18

View online: https://www.drupal.org/sa-contrib-2018-045 Project: Universally Unique IDentifier [1] Date: 2018-July-04 Security risk: *Moderately critical* 12∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Arbitrary file upload Description: This module provides an API for adding universally unique identifiers (UUID) to Drupal objects, most notably entities. The module module has an arbitrary file upload vulnerability when it's used in combination with the services REST server. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to allow to upload to the file create REST endpoint. Solution: * If you use the uuid module for Drupal 7.x, upgrade to uuid 7.x-1.1 [3] Also see the Universally Unique IDentifier [4] project page Reported By: * Gustavo Iñiguez Goia [5] Fixed By: * Manuel Garcia [6] Coordinated By: * Michael Hess [7] Of the Drupal Security Team [1] https://www.drupal.org/project/uuid [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/uuid/releases/7.x-1.1 [4] https://www.drupal.org/project/uuid [5] https://www.drupal.org/user/3419891 [6] https://www.drupal.org/user/213194 [7] https://www.drupal.org/u/mlhess

1 0

TFA Basic plugins - Less critical - Insecure Randomness - SA-CONTRIB-2018-044
by security-news＠drupal.org 27 Jun '18

27 Jun '18

View online: https://www.drupal.org/sa-contrib-2018-044 Project: TFA Basic plugins [1] Version: 7.x-1.0 Date: 2018-June-27 Security risk: *Less critical* 9∕25 AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Insecure Randomness Description: The TFA Basic module enables you to use Two Factor Authentication via a variety of plugins including TOTP and one-time codes delivered via email or sms. The module doesn't use a strong source of randomness, creating weak and predictable one-time login codes that are then delivered using SMS. This weakness does not affect the more common TOTP second factor. This vulnerability is mitigated by the fact that the site must be configured to use SMS to deliver one-time login codes which is an uncommon configuration. Solution: * If you use the TFA Basic module for Drupal 7.x, upgrade to TFA Basic 7.x-1.1 [3] Also see the TFA Basic plugins [4] project page. Reported By: * Greg Knaddison [5] of the Drupal Security Team Fixed By: * Greg Knaddison [6] of the Drupal Security Team * Ben Jeavons [7] of the Drupal Security Team Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/tfa_basic [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/tfa_basic/releases/7.x-1.1 [4] https://www.drupal.org/project/tfa_basic [5] https://www.drupal.org/user/36762 [6] https://www.drupal.org/user/36762 [7] https://www.drupal.org/user/91990 [8] https://www.drupal.org/u/greggles

1 0

Mass Password Reset - Less critical - Insecure Randomness - SA-CONTRIB-2018-043
by security-news＠drupal.org 27 Jun '18

27 Jun '18

View online: https://www.drupal.org/sa-contrib-2018-043 Project: Mass Password Reset [1] Version: 7.x-1.0 Date: 2018-June-27 Security risk: *Less critical* 9∕25 AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Insecure Randomness Description: This module enables you to reset passwords for all users based upon their user role. The module doesn't use a strong source of randomness, creating weak and predictable passwords. This vulnerability is mitigated by the fact that the site must be configured to reveal the password to the attacker, which is a common configuration. Solution: Install the latest version: * If you use the Mass Password Reset module for Drupal 7.x, upgrade to Mass Password Reset 7.x-1.1 [3]. Also see the Mass Password Reset [4] project page. Reported By: * Greg Knaddison [5] of the Drupal Security Team Fixed By: * Greg Knaddison [6] of the Drupal Security Team * Mark Shropshire [7] Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/mass_pwreset [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/mass_pwreset/releases/7.x-1.1 [4] https://www.drupal.org/project/mass_pwreset [5] https://www.drupal.org/user/36762 [6] https://www.drupal.org/user/36762 [7] https://www.drupal.org/user/14767 [8] https://www.drupal.org/u/greggles

1 0

Generate Password - Less critical - Insecure Randomness - SA-CONTRIB-2018-042
by security-news＠drupal.org 27 Jun '18

27 Jun '18

View online: https://www.drupal.org/sa-contrib-2018-042 Project: Generate Password [1] Version: 7.x-1.x-dev Date: 2018-June-27 Security risk: *Less critical* 9∕25 AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Insecure Randomness Description: The Genpass module makes the password field optional (or hidden) on the add new user page (admin & registration). If the password field is not set during registration, the system generates a password. The module doesn't use a strong source of randomness, creating weak and predictable passwords. This vulnerability is mitigated by the fact that the site must be configured to reveal the password to the attacker which is a common configuration. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ Solution: Install the latest version: * If you use the Genpass module for Drupal 7.x-1.x, upgrade to Genpass 7.x-1.1 [4] Also see the Generate Password [5] project page. Reported By: * Greg Knaddison [6] of the Drupal Security Team Fixed By: * Joel Stein [7] a module maintainer Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/genpass [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/genpass/releases/7.x-1.1 [5] https://www.drupal.org/project/genpass [6] https://www.drupal.org/user/36762 [7] https://www.drupal.org/user/36598 [8] https://www.drupal.org/u/greggles

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news