Security-news

security-news@drupal.org

1 participants
1782 discussions

ComScore direct tag - Critical - Unsupported - SA-CONTRIB-2017-095
by security-news＠drupal.org 20 Dec '17

20 Dec '17

View online: https://www.drupal.org/sa-contrib-2017-095 Project: ComScore direct tag [1] Date: 2017-December-20 Security risk: *Critical* 18∕25 AC:None/A:None/CI:Some/II:Some/E:Proof/TD:Default [2] Vulnerability: Unsupported Description: A simple module to add in the JS for the comScore Direct tag to your Drupal site. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. The security team takes action in cases like this without regard to the severity of the security issue in question. If you would like to maintain this module, please read: https://www.drupal.org/node/251466 [3] All projects that are being marked unsupported are given a score of critical. Code that is no longer maintained poses a threat to securing sites. Solution: If you use the ComScore Direct tag module for Drupal you should uninstall it. Reported By: Balazs Janos Tatar [4] Fixed By: N/A [1] https://www.drupal.org/project/comscore_direct [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466 [4] https://www.drupal.org/u/tatarbj

1 0

Link Click Count - Critical - Unsupported - SA-CONTRIB-2017-094
by security-news＠drupal.org 20 Dec '17

20 Dec '17

View online: https://www.drupal.org/sa-contrib-2017-094 Project: Link Click Count [1] Date: 2017-December-20 Security risk: *Critical* 18∕25 AC:None/A:None/CI:Some/II:Some/E:Proof/TD:Default [2] Vulnerability: Unsupported Description: The Link Click Count module helps you to monitor the traffic to your website by creating link fields. These link fields can be individual links or internal/external links that can be added to the content type. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. The security team takes action in cases like this without regard to the severity of the security issue in question. If you would like to maintain this module, please read: https://www.drupal.org/node/251466 [3] All projects that are being marked unsupported are given a score of critical. Code that is no longer maintained poses a threat to securing sites. Solution: If you use the link click count module for Drupal you should uninstall it. Reported By: Karthik Kumar D K [4] Fixed By: N/A [1] https://www.drupal.org/project/link_click_count [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466 [4] https://www.drupal.org/u/heykarthikwithu

1 0

Panopoly Core - Moderately critical - Cross Site Scripting - SA-CONTRIB-2017-093
by security-news＠drupal.org 13 Dec '17

13 Dec '17

View online: https://www.drupal.org/sa-contrib-2017-093 Project: Panopoly Core [1] Version: 7.x-1.x-dev Date: 2017-December-13 Security risk: *Moderately critical* 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Scripting Description: This module provides common functionality used by other modules in the Panopoly distribution and child distributions, like, Open Atrium. The module doesn't sufficiently filter node titles used in breadcrumbs when the "Append Page Title to Site Breadcrumb" setting is enabled. This vulnerability is mitigated by the fact that an attacker must have a role with the ability to create content. Solution: Install the latest version: * If you use the Panopoly Core module for Drupal 7.x, upgrade to Panopoly Core 7.x-1.49 [3] Reported By: * Brian Osborne [4] Fixed By: * David Snopek [5] the module maintainer * Brian Osborne [6] Coordinated By: * David Snopek [7] of the Drupal Security Team [1] https://www.drupal.org/project/panopoly_core [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/panopoly_core/releases/7.x-1.49 [4] https://www.drupal.org/user/788032 [5] https://www.drupal.org/user/266527 [6] https://www.drupal.org/user/788032 [7] https://www.drupal.org/user/266527

1 0

Node feedback - Moderately critical - Access Bypass - SA-CONTRIB-2017-092
by security-news＠drupal.org 06 Dec '17

06 Dec '17

View online: https://www.drupal.org/sa-contrib-2017-092 Project: Node feedback [1] Version: 7.x-1.2 Date: 2017-December-06 Security risk: *Moderately critical* 12∕25 AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access Bypass Description: This module enables you to set nodes to send feedbacks by personal/site wide contact forms. The module doesn't sufficiently handle the access to nodes whose titles will be shown on contact forms. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Use the site-wide contact form" or "Use users' personal contact forms" which is often assigned to untrusted user roles such as anonymous. Solution: Install the latest version: * If you use the node feedback module for Drupal 7, upgrade to node feedback 7.x-1.3 [3] Also see the Node feedback [4] project page. Reported By: * Tatar Balazs Janos [5] Fixed By: * Tatar Balazs Janos [6] * Bhavin H. Joshi [7] the module maintainer Coordinated By: * Greg Knaddison [8] of the Drupal Security Team * Lee Rowlands [9] of the Drupal Security Team [1] https://www.drupal.org/project/node_feedback [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/node_feedback/releases/7.x-1.3 [4] https://www.drupal.org/project/node_feedback [5] https://www.drupal.org/u/tatarbj [6] https://www.drupal.org/u/tatarbj [7] https://www.drupal.org/user/219482 [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/larowlan

1 0

Configuration Update Manager - Moderately critical - Cross Site Request Forgery (CSRF) - SA-CONTRIB-2017-091
by security-news＠drupal.org 06 Dec '17

06 Dec '17

View online: https://www.drupal.org/sa-contrib-2017-091 Project: Configuration Update Manager [1] Version: 8.x-1.4 Date: 2017-December-06 Security risk: *Moderately critical* 12∕25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Request Forgery (CSRF) Description: The Configuration Update Reports sub-module in the Configuration Update module project enables you to run reports to see what configuration on your site differs from the configuration distributed by a module, theme, or installation profile, and to revert, delete, or import configuration. This module doesn't sufficiently protect the Import operation, thereby exposing a Cross Site Request Forgery (CSRF) vulnerability which can be exploited by unprivileged users to trick an administrator into unwanted import of configuration. This vulnerability is mitigated by the fact that only configuration items distributed with a module, theme, or installation profile that is currently installed and enabled on the site can be imported, not arbitrary configuration values. Solution: Install the latest version: * If you use the Configuration Update Manager module and its Reports sub-module for Drupal 8.x, upgrade to Configuration Update Manager version 8.x-1.5 [3] Alternatively, you could remove the permission "import configuration" from all roles on the site, or uninstall the Configuration Update Reports sub-module from your production sites. Also see the Configuration Update Manager [4] project page. Reported By: * Jean-Francois Hovinne [5] Fixed By: * Jennifer Hodgdon [6] the module maintainer Coordinated By: * Greg Knaddison [7] of the Drupal Security Team * Lee Rowlands [8] of the Drupal Security Team [1] https://www.drupal.org/project/config_update [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/config_update/releases/8.x-1.5 [4] https://www.drupal.org/project/config_update [5] https://www.drupal.org/u/jfhovinne [6] https://www.drupal.org/u/jhodgdon [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/larowlan

1 0

Feedback Collect - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2017-090
by security-news＠drupal.org 06 Dec '17

06 Dec '17

View online: https://www.drupal.org/sa-contrib-2017-090 Project: Feedback Collect [1] Version: 7.x-1.5 Date: 2017-December-06 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting (XSS) Description: This module enables you to add feedback forms and gather end user feedback, bug reports or any kind of suggestions. The module doesn't sufficiently filter output of its own fields under the scenario of creating or editing feedback-collect content types. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "create feedback-collect content" or its related editing permissions. Solution: Install the latest version: * If you use the feedback collect module for Drupal 7.x, upgrade to feedback collect 7.x-1.6 [3] Also see the Feedback Collect [4] project page. Reported By: * Tatar Balazs Janos [5] Fixed By: * Tatar Balazs Janos [6] * Jelena Krmar [7] the module maintainer Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/feedback_collect [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/feedback_collect/releases/7.x-1.6 [4] https://www.drupal.org/project/feedback_collect [5] https://www.drupal.org/u/tatarbj [6] https://www.drupal.org/u/tatarbj [7] https://www.drupal.org/user/3097287 [8] https://www.drupal.org/u/greggles

1 0

Mailhandler - Critical - Remote Code Execution - SA-CONTRIB-2017-089
by security-news＠drupal.org 06 Dec '17

06 Dec '17

View online: https://www.drupal.org/sa-contrib-2017-089 Project: Mailhandler [1] Version: 7.x-2.10 Date: 2017-December-06 Security risk: *Critical* 17∕25 AC:Complex/A:User/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Remote Code Execution Description: The Mailhandler module enables you to create nodes by email. The Mailhandler module does not validate file attachments. By sending a correctly crafted e-mail to a mailhandler mailbox an attacker can execute arbitrary code. The vulnerability applies to any active mailhandler mailbox, whether or not attachments are mapped to a field. *Mitigating factors:* * For 7.x versions prior to 7.x-2.5, the vulnerability is mitigated by the fact that the 'MailhandlerCommandsFiles' plugin must be enabled. For later versions, the option to disable commands was removed, all commands are enabled in any case. * The vulnerability is mitigated by the fact that the attacker must pass the authentication step. The default authentication is that the attacker must send the crafted e-mail from a registered e-mail address. * The vulnerability is mitigated by the fact that the mailhandler mailbox e-mail address must be known by the attacker. This essentially depends on the usecase, e.g. Mailcomment module. * The vulnerability is mitigated by the fact that the webserver configuration must either permit the execution of some file extensions in the public filesystem or (Apache) has '.htaccess' support enabled through the AllowOverride directive. Solution: Install the latest version: * If you use the Mailhandler module for Drupal 7.x, upgrade to Mailhandler 7.x-2.11 [3] Also see the Mailhandler [4] project page. Reported By: * Marc Darcis [5] Fixed By: * Marc Darcis [6] * Nathaniel Catchpole [7] * Milos Bovan [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/mailhandler [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/mailhandler/releases/7.x-2.11 [4] https://www.drupal.org/project/mailhandler [5] https://www.drupal.org/user/3552485 [6] https://www.drupal.org/user/3552485 [7] https://www.drupal.org/user/35733 [8] https://www.drupal.org/u/mbovan [9] https://www.drupal.org/u/greggles

1 0

bootstrap_carousel - Moderately critical - Cross Site Scripting - SA-CONTRIB-2017-088
by security-news＠drupal.org 29 Nov '17

29 Nov '17

View online: https://www.drupal.org/sa-contrib-2017-088 Project: bootstrap_carousel [1] Version: 7.x-1.x-dev Date: 2017-November-29 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: This module provides a way to make carousels, based on bootstrap-carousel.js. The module doesn't sufficiently handle output of img HTML tag's alt property. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Carousel: Create new content" or any similar node module permissions for creating/editing/removing the module-delivered content type. Solution: Install the latest version: * If you use the bootstrap_carousel module for Drupal 7, upgrade to bootstrap_carousel 7.x-1.2 [3] Reported By: * Tatar Balazs Janos [4] Fixed By: * Tatar Balazs Janos [5] * Jean Kemparski Ribeiro [6] the module maintainer Coordinated By: * Tatar Balazs Janos [7] * Michael Hess [8] of the Drupal Security Team [1] https://www.drupal.org/project/bootstrap_carousel [2] https://www.drupal.org/security-team/risk-levels [3] https://drupal.org/node/2926863 [4] https://www.drupal.org/u/tatarbj [5] https://www.drupal.org/u/tatarbj [6] https://www.drupal.org/user/1975716 [7] https://www.drupal.org/u/tatarbj [8] https://www.drupal.org/u/mlhess

1 0

Services single sign-on client - Critical - Cross-site scripting - SA-CONTRIB-2017-087
by security-news＠drupal.org 29 Nov '17

29 Nov '17

View online: https://www.drupal.org/sa-contrib-2017-087 Project: Services single sign-on client [1] Version: 7.x-1.x-dev Date: 2017-November-29 Security risk: *Critical* 16∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site scripting Description: This module allows users of a remote Services-enabled Drupal site to sign on to a second site with their credentials. The module does not sanitize information from the request before displaying it, thereby exposing a cross-site scripting vulnerability. Solution: Install the latest version: * If you use the Services Single Sign-on Client module for Drupal 7.x, upgrade to Services Single Sign-on Client 7.x-1.6 [3] Reported By: * Scott Allison [4] Fixed By: * Scott Allison [5] * Brandon Stone [6] the module maintainer Coordinated By: * David Rothstein [7] of the Drupal Security Team * Lee Rowlands [8] of the Drupal Security Team [1] https://www.drupal.org/project/services_sso_client [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/services_sso_client/releases/7.x-1.6 [4] https://www.drupal.org/u/scottallison [5] https://www.drupal.org/u/scottallison [6] https://www.drupal.org/u/branana [7] https://www.drupal.org/u/david_rothstein [8] https://www.drupal.org/u/larowlan

1 0

Cloud - Critical - CSRF - SA-CONTRIB-2017-086
by security-news＠drupal.org 29 Nov '17

29 Nov '17

View online: https://www.drupal.org/sa-contrib-2017-086 Project: Cloud [1] Version: 7.x-1.x-dev Date: 2017-November-29 Security risk: *Critical* 18∕25 AC:None/A:User/CI:Some/II:All/E:Theoretical/TD:All [2] Vulnerability: CSRF Description: This module enables sites to manage public clouds like Amazon EC2 and also private clouds like OpenStack. The module doesn't sufficiently protect the deletion of audit reports, thereby exposing a cross-site request vulnerability which can be exploited by unprivileged users to trick an administrator into unwanted deletion of audit reports. This vulnerability is mitigated by the fact that the victim must have a role with the permission "access audit report". Solution: Install the latest version: * If you use the Cloud module for Drupal 7, upgrade to Cloud 7.x-1.7 [3] Reported By: * Tatar Balazs Janos [4] Fixed By: * Tatar Balazs Janos [5] * Yas Naoi [6] the module maintainer Coordinated By: * Tatar Balazs Janos [7] [1] https://www.drupal.org/project/cloud [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/cloud/releases/7.x-1.7 [4] https://www.drupal.org/u/tatarbj [5] https://www.drupal.org/u/tatarbj [6] https://www.drupal.org/u/yas [7] https://www.drupal.org/u/tatarbj

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news