- Security-news - lists.drupal.org

Module Filter - Moderately critical - Cross site scripting - SA-CONTRIB-2019-042
by security-news＠drupal.org 27 Mar '19

27 Mar '19

View online: https://www.drupal.org/sa-contrib-2019-042 Project: Module Filter [1] Version: 7.x-2.x-dev Date: 2019-March-27 Security risk: *Moderately critical* 12∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross site scripting Description: This module enables you to filter the list of modules on the admin modules page, and organizes packages into vertical tabs. The module doesn't sufficiently escape HTML under the scenario leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that the attacker must have access to input filtered html that will be included on the modules administration page e.g. in a block (this configuration is not common). Further, the Module Filter vertical tabs setting must be enabled. Solution: Install the latest version: * If you use the Module Filter module for Drupal 7.x, upgrade to Module Filter 7.x-2.2 [3] Also see the Module Filter [4] project page. Reported By: * Yonatan Offek [5] Fixed By: * greenSkin [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team [1] https://www.drupal.org/project/module_filter [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/module_filter/releases/7.x-2.2 [4] https://www.drupal.org/project/module_filter [5] https://www.drupal.org/user/194009 [6] https://www.drupal.org/user/173855 [7] https://www.drupal.org/user/36762

1 0

Drupal core - Moderately critical - Cross Site Scripting - SA-CORE-2019-004
by security-news＠drupal.org 20 Mar '19

20 Mar '19

View online: https://www.drupal.org/sa-core-2019-004 Project: Drupal core [1] Date: 2019-March-20 Security risk: *Moderately critical* 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Scripting Description: Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability. Solution: * If you are using Drupal 8.6, update to Drupal 8.6.13 [3]. * If you are using Drupal 8.5 or earlier, update to Drupal 8.5.14 [4]. * If you are using Drupal 7, update to Drupal 7.65 [5]. Versions of Drupal 8 prior to 8.5.x are end-of-life and do not receive security coverage. Reported By: * Zero Day Initiative [6] Fixed By: * Alex Pott [7] of the Drupal Security Team * Lee Rowlands [8] of the Drupal Security Team * Greg Knaddison [9] of the Drupal Security Team * Neil Drumm [10] of the Drupal Security Team * Michael Hess [11] of the Drupal Security Team * David Rothstein [12] of the Drupal Security Team * Peter Wolanin [13] of the Drupal Security Team [1] https://www.drupal.org/project/drupal [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/drupal/releases/8.6.13 [4] https://www.drupal.org/project/drupal/releases/8.5.14 [5] https://www.drupal.org/project/drupal/releases/7.65 [6] https://www.drupal.org/user/3594938 [7] https://www.drupal.org/user/157725 [8] https://www.drupal.org/user/395439 [9] https://www.drupal.org/user/36762 [10] https://www.drupal.org/user/3064 [11] https://www.drupal.org/user/102818 [12] https://www.drupal.org/user/124982 [13] https://www.drupal.org/user/49851

1 0

Back To Top - Moderately critical - Cross Site Scripting - SA-CONTRIB-2019-040
by security-news＠drupal.org 20 Mar '19

20 Mar '19

View online: https://www.drupal.org/sa-contrib-2019-040 Project: Back To Top [1] Date: 2019-March-20 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: This module enables you to add a button that hovers in the bottom of your screen and allows users to smoothly scroll up the page using jQuery. The module doesn't sufficiently sanitize the code that gets printed on pages leading to a Cross Site Scripting (XSS) issue. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access backtotop settings". Solution: Install the latest version: * If you use the Back To Top module for Drupal 7.x, upgrade to Back To Top 7.x-1.6 [3] Reported By: * Balazs Janos Tatar [4] Fixed By: * Mattias Axelsson [5] * Balazs Janos Tatar [6] Coordinated By: * Balazs Janos Tatar [7] [1] https://www.drupal.org/project/back_to_top [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/back_to_top/releases/7.x-1.6 [4] https://www.drupal.org/user/649590 [5] https://www.drupal.org/user/765764 [6] https://www.drupal.org/user/649590 [7] https://www.drupal.org/user/649590

1 0

RESTful - Critical - Remote code execution - SA-CONTRIB-2019-041
by security-news＠drupal.org 20 Mar '19

20 Mar '19

View online: https://www.drupal.org/sa-contrib-2019-041 Project: RESTful [1] Date: 2019-March-20 Security risk: *Critical* 18∕25 AC:Complex/A:User/CI:All/II:All/E:Exploit/TD:Uncommon [2] Vulnerability: Remote code execution Description: This resolves issues described in SA-CORE-2019-003 [3] for this module. Solution: * If you use the RESTful module for Drupal 7.x, upgrade to RESTful 7.x-1.10 [4] or RESTful 7.x-2.17 [5] [1] https://www.drupal.org/project/restful [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/sa-core-2019-003 [4] https://www.drupal.org/project/restful/releases/7.x-1.10 [5] https://www.drupal.org/project/restful/releases/7.x-2.17

1 0

AddToAny Share Buttons - Moderately critical - Cross Site Scripting - SA-CONTRIB-2019-039
by security-news＠drupal.org 20 Mar '19

20 Mar '19

View online: https://www.drupal.org/sa-contrib-2019-039 Project: AddToAny Share Buttons [1] Date: 2019-March-20 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: This module enables you to add social media share buttons on your website to its content and pages. The module doesn't sufficiently mark its administration permission restricted, allowing cross site scripting vulnerabilities to users who have access to its admin settings. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer addtoany". Solution: * If you use the AddToAny Share Buttons module for Drupal 7.x, upgrade to AddToAny Share Buttons 7.x-4.16 [3] Reported By: * Balazs Janos Tatar [4] Fixed By: * Balazs Janos Tatar [5] * micropat [6] Coordinated By: * Balazs Janos Tatar [7] [1] https://www.drupal.org/project/addtoany [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/addtoany/releases/7.x-4.16 [4] https://www.drupal.org/user/649590 [5] https://www.drupal.org/user/649590 [6] https://www.drupal.org/user/260224 [7] https://www.drupal.org/user/649590

1 0

Views - Moderately critical - Information Disclosure - SA-CONTRIB-2019-034
by security-news＠drupal.org 13 Mar '19

13 Mar '19

View online: https://www.drupal.org/sa-contrib-2019-034 Project: Views [1] Version: 7.x-3.x-dev Date: 2019-March-13 Security risk: *Moderately critical* 10∕25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Information Disclosure Description: This module enables you to create customized lists of data. The module doesn't sufficiently protect against argument definitions failing. This vulnerability is mitigated by the fact that a view must have custom PHP code used as a field validator. Solution: Install the latest version: * If you use the Views module for Drupal 7.x, upgrade to Views 7.x-3.21 [3] Also see the Views [4] project page. Reported By: * Fabien Leroux [5] Fixed By: * Fabien Leroux [6] * Daniel Wehner [7] * Damien McKenna [8] of the Drupal Security Team * Len Swaneveld [9] Coordinated By: * Michael Hess [10] of the Drupal Security Team. -------- ADDITIONAL INFORMATION ---------------------------------------------- Note: Drupal issues individual security advisories for separate vulnerabilities included in a release, rather than lumping "multiple vulnerabilities" into a single advisory. All advisories released today for Views: * SA-CONTRIB-2019-034 [11] * SA-CONTRIB-2019-035 [12] * SA-CONTRIB-2019-036 [13] [1] https://www.drupal.org/project/views [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/views/releases/7.x-3.21 [4] https://www.drupal.org/project/views [5] https://www.drupal.org/user/407852 [6] https://www.drupal.org/user/407852 [7] https://www.drupal.org/user/99340 [8] https://www.drupal.org/user/108450 [9] https://www.drupal.org/user/690914 [10] https://www.drupal.org/u/mlhess [11] https://www.drupal.org/sa-contrib-2019-034 [12] https://www.drupal.org/sa-contrib-2019-035 [13] https://www.drupal.org/sa-contrib-2019-036

1 0

Views - Moderately critical - Information disclosure - SA-CONTRIB-2019-035
by security-news＠drupal.org 13 Mar '19

13 Mar '19

View online: https://www.drupal.org/sa-contrib-2019-035 Project: Views [1] Version: 7.x-3.x-dev Date: 2019-March-13 Security risk: *Moderately critical* 10∕25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Information disclosure Description: This module enables you to create customized lists of data. The module doesn't sufficiently build queries when used with exposed filters, leading to a possible information disclosure vulnerability in certain rare circumstances. This vulnerability is mitigated by the fact that a view must have an exposed filter on a field that is used on multiple entity types, both of which are included in the view. Solution: Install the latest version: * If you use the Views module for Drupal 7.x, upgrade to Views 7.x-3.21 [3] Also see the Views [4] project page. Reported By: * Lucas Hedding [5] Fixed By: * Klaus Purer [6] * Lucas Hedding [7] * Greg Knaddison [8] of the Drupal Security Team * Aaron Zinck [9] * Daniel Wehner [10] * Damien McKenna [11] of the Drupal Security Team * Vijaya Chandran Mani [12] Coordinated By: * Damien McKenna [13] of the Drupal Security Team. -------- ADDITIONAL INFORMATION ---------------------------------------------- Note: Drupal issues individual security advisories for separate vulnerabilities included in a release, rather than lumping "multiple vulnerabilities" into a single advisory. All advisories released today for Views: * SA-CONTRIB-2019-034 [14] * SA-CONTRIB-2019-035 [15] * SA-CONTRIB-2019-036 [16] [1] https://www.drupal.org/project/views [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/views/releases/7.x-3.21 [4] https://www.drupal.org/project/views [5] https://www.drupal.org/user/1463982 [6] https://www.drupal.org/user/262198 [7] https://www.drupal.org/user/1463982 [8] https://www.drupal.org/user/36762 [9] https://www.drupal.org/user/518662 [10] https://www.drupal.org/user/99340 [11] https://www.drupal.org/user/108450 [12] https://www.drupal.org/user/93488 [13] https://www.drupal.org/u/damienmckenna [14] https://www.drupal.org/sa-contrib-2019-034 [15] https://www.drupal.org/sa-contrib-2019-035 [16] https://www.drupal.org/sa-contrib-2019-036

1 0

Views - Less critical - Cross site scripting - SA-CONTRIB-2019-036
by security-news＠drupal.org 13 Mar '19

13 Mar '19

View online: https://www.drupal.org/sa-contrib-2019-036 Project: Views [1] Version: 7.x-3.x-dev Date: 2019-March-13 Security risk: *Less critical* 7∕25 AC:Complex/A:None/CI:None/II:None/E:Theoretical/TD:Uncommon [2] Vulnerability: Cross site scripting Description: This module enables you to create customized lists of data. The module doesn't sufficiently sanitize certain field types, leading to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that a view must display a field with the format "Full data (serialized)" and an attacker must have the ability to store malicious markup in that field. Solution: Install the latest version: * If you use the Views module for Drupal 7.x, upgrade to Views 7.x-3.21 [3] Also see the Views [4] project page. Reported By: * Ralf Stamm [5] Fixed By: * Ralf Stamm [6] * Damian Lee [7] * Daniel Wehner [8] * David Snopek [9] of the Drupal Security Team * Nate Lampton [10] Coordinated By: * Michael Hess [11] of the Drupal Security Team. -------- ADDITIONAL INFORMATION ---------------------------------------------- Note: Drupal issues individual security advisories for separate vulnerabilities included in a release, rather than lumping "multiple vulnerabilities" into a single advisory. All advisories released today for Views: * SA-CONTRIB-2019-034 [12] * SA-CONTRIB-2019-035 [13] * SA-CONTRIB-2019-036 [14] [1] https://www.drupal.org/project/views [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/views/releases/7.x-3.21 [4] https://www.drupal.org/project/views [5] https://www.drupal.org/user/43568 [6] https://www.drupal.org/user/43568 [7] https://www.drupal.org/user/1037976 [8] https://www.drupal.org/user/99340 [9] https://www.drupal.org/user/266527 [10] https://www.drupal.org/user/35821 [11] https://www.drupal.org/u/mlhess [12] https://www.drupal.org/sa-contrib-2019-034 [13] https://www.drupal.org/sa-contrib-2019-035 [14] https://www.drupal.org/sa-contrib-2019-036

1 0

Video - Critical - Remote Code Execution - SA-CONTRIB-2019-037
by security-news＠drupal.org 13 Mar '19

13 Mar '19

View online: https://www.drupal.org/sa-contrib-2019-037 Project: Video [1] Date: 2019-March-13 Security risk: *Critical* 19∕25 AC:None/A:Admin/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Remote Code Execution Description: This module provides a field where editors can add videos to their content and this module offers functionality to transcode these videos to different sizes and formats. The module doesn't sufficiently sanitize some user input on administrative forms. Solution: * If you use the Video module for Drupal 7.x, upgrade to Video 7.x-2.14 [3] Also see the Video [4] project page Note that the Drupal 8 version of this module is unaffected. Reported By: * Samuel Mortenson [5] of the Drupal Security Team Fixed By: * Michael Hess [6] of the Drupal Security Team * Jorrit Schippers [7] * Samuel Mortenson [8] of the Drupal Security Team * Greg Knaddison [9] of the Drupal Security Team Coordinated By: * Michael Hess [10] of the Drupal Security Team [1] https://www.drupal.org/project/video [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/video/releases/7.x-2.14 [4] https://www.drupal.org/project/video [5] https://www.drupal.org/user/2582268 [6] https://www.drupal.org/user/102818 [7] https://www.drupal.org/user/161217 [8] https://www.drupal.org/user/2582268 [9] https://www.drupal.org/user/36762 [10] https://www.drupal.org/user/102818

1 0

Simple hierarchical select - Moderately critical - Cross site request forgery - SA-CONTRIB-2019-038
by security-news＠drupal.org 13 Mar '19

13 Mar '19

View online: https://www.drupal.org/sa-contrib-2019-038 Project: Simple hierarchical select [1] Date: 2019-March-13 Security risk: *Moderately critical* 10∕25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross site request forgery Description: Simple hierarchical select defines a new form widget for taxonomy fields to select a term by "browsing" through the vocabularies hierarchy. It also allows users to create new taxonomy terms using its widget directly in the node form. Version 7.x of Simple hierarchical select doesn't sufficiently checks permission when creating new terms so attackers can create arbitrary taxonomy terms in any vocabularies the victim has access to.. This vulnerability is mitigated by the fact that an attacker must trick a user with permission to create terms to visit a specially prepared web page controlled by the attacker. Solution: Install the latest version: * If you use /Simple hierarchical select/ prior to 7.x-1.7 update to 7.x-1.8 [3] * If you are unable to update, simply deactivate the option to allow creating new terms in the widget settings. Note that the Drupal 8 version of this module is unaffected. Reported By: * Ayesh Karunaratne [4] Fixed By: * Ayesh Karunaratne [5] * Stefan Borchert [6] * Greg Knaddison [7] of the Drupal Security Team Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/shs [2] https://www.drupal.org/security-team/risk-levels [3] node/3039685 [4] https://www.drupal.org/user/796148 [5] https://www.drupal.org/user/796148 [6] https://www.drupal.org/user/36942 [7] https://www.drupal.org/user/36762 [8] https://www.drupal.org/user/36762

1 0