Security-news

security-news@drupal.org

1 participants
1782 discussions

MoneySuite - Moderately critical - Access bypass - SA-CONTRIB-2017-085
by security-news＠drupal.org 29 Nov '17

29 Nov '17

View online: https://www.drupal.org/sa-contrib-2017-085 Project: MoneySuite [1] Version: 7.x-10.x-dev Date: 2017-November-29 Security risk: *Moderately critical* 14∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Description: MoneySuite provides a set of modules for Drupal sites that rely on the sale of memberships and/or content for revenue. The modules have an access bypass vulnerability which allows untrusted users (including anonymous users) to view payments made by users within the system. No data can be modified, nor are any credit card numbers displayed. Solution: Install the latest version: * If you use the MoneySuite module for Drupal 7.x, upgrade to MoneySuite 7.x-10.4 [3] Reported By: * Anthony Lindsay [4] Fixed By: * Anthony Lindsay [5] * Clive Murden [6] the module maintainer * Farreres [7] the module maintainer Coordinated By: * David Rothstein [8] of the Drupal Security Team [1] https://www.drupal.org/project/moneysuite [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/moneysuite/releases/7.x-10.4 [4] https://www.drupal.org/u/anthonylindsay [5] https://www.drupal.org/u/anthonylindsay [6] https://www.drupal.org/u/clivem [7] https://www.drupal.org/u/farreres [8] https://www.drupal.org/user/124982

1 0

Domain Integration - Moderately critical - Access bypass - SA-CONTRIB-2017-084
by security-news＠drupal.org 29 Nov '17

29 Nov '17

View online: https://www.drupal.org/sa-contrib-2017-084 Project: Domain Integration [1] Version: 7.x-1.x-dev Date: 2017-November-29 Security risk: *Moderately critical* 13∕25 AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: This module enables you to integrate the Domain module with other popular Drupal modules. The Domain Integration Login Restrict sub-module enables you to restrict access to a domain based on the assigned domains on a user. The Domain Integration Login Restrict sub-module doesn't sufficiently check these restrictions when using one-time logins. This vulnerability is mitigated by the fact that an attacker must have an active account on one of the domains. Solution: Install the latest version: * If you use the Domain Integration module for Drupal 7.x, upgrade to Domain Integration 7.x-1.2 [3] Reported By: * Dominique Climenti [4] Fixed By: * Dominique Climenti [5] * Len Swaneveld [6] the module maintainer * Niels de Feyter [7] the module maintainer * David Rothstein [8] of the Drupal Security Team * Michael Hess [9] of the Drupal Security Team Coordinated By: * David Rothstein [10] of the Drupal Security Team [1] https://www.drupal.org/project/domain_integration [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/domain_integration/releases/7.x-1.2 [4] https://www.drupal.org/user/3549871 [5] https://www.drupal.org/user/3549871 [6] https://www.drupal.org/user/690914 [7] https://www.drupal.org/user/599438 [8] https://www.drupal.org/user/124982 [9] https://www.drupal.org/user/102818 [10] https://www.drupal.org/user/124982

1 0

Permissions by Term - Moderately critical - Access bypass - SA-CONTRIB-2017-082
by security-news＠drupal.org 08 Nov '17

08 Nov '17

View online: https://www.drupal.org/sa-contrib-2017-082 Project: Permissions by Term [1] Version: 8.x-1.x-dev Date: 2017-November-08 Security risk: *Moderately critical* 14∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Description: The Permissions by Term module extends Drupal by adding functionality for restricting access to single nodes via taxonomy terms. The module grants access to nodes that are being blocked by other node access modules and that the Permissions by Term module does not intend to control. Additionally, it grants access to unpublished nodes in node listings to users who should not be able to see them. These problems lead to an access bypass vulnerability. This vulnerability is mitigated by the fact that it only occurs on sites that either have another node access module (besides Permissions by Term) in use, or that have node listings that are accessible to unprivileged users and that don't directly filter out unpublished content. Solution: Install the latest version: * If you use the Permissions by Term module for Drupal 8, upgrade to Permissions by Term 8.x-1.35 [3] Reported By: * David Rothstein [4] of the Drupal Security Team Fixed By: * David Rothstein [5] of the Drupal Security Team * Peter Majmesku [6] the module maintainer Coordinated By: * David Rothstein [7] of the Drupal Security Team [1] https://www.drupal.org/project/permissions_by_term [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/permissions_by_term/releases/8.x-1.35 [4] https://www.drupal.org/u/david_rothstein [5] https://www.drupal.org/u/david_rothstein [6] https://www.drupal.org/u/peter-majmesku [7] https://www.drupal.org/user/124982

1 0

Custom Permissions - Moderately critical - Access bypass - SA-CONTRIB-2017-083
by security-news＠drupal.org 08 Nov '17

08 Nov '17

View online: https://www.drupal.org/sa-contrib-2017-083 Project: Custom Permissions [1] Version: 8.x-1.x-dev Date: 2017-November-08 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Description: Custom Permissions is a lightweight module that allows permissions to be created and managed through an administrative form. When this module is in use, any user who is able to perform an action which rebuilds some of Drupal's caches can trigger a scenario in which certain pages protected by this module's custom permissions temporarily lose those custom access controls, thereby leading to an access bypass vulnerability. Solution: Install the latest version: * If you use the Custom Permissions module for Drupal 8, upgrade to Custom Permissions 8.x-1.1 [3] Reported By: * Michael Koza [4] * David Rothstein [5] of the Drupal Security Team Fixed By: * David Valdez [6] the module maintainer * David Rothstein [7] of the Drupal Security Team Coordinated By: * David Rothstein [8] of the Drupal Security Team [1] https://www.drupal.org/project/config_perms [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/config_perms/releases/8.x-1.1 [4] https://www.drupal.org/user/2110062 [5] https://www.drupal.org/user/124982 [6] http://drupal.org/u/gnuget [7] https://www.drupal.org/user/124982 [8] https://www.drupal.org/user/124982

1 0

Automated Logout - Moderately critical - Cross Site Scripting - SA-CONTRIB-2017-081
by security-news＠drupal.org 01 Nov '17

01 Nov '17

View online: https://www.drupal.org/sa-contrib-2017-081 Project: Automated Logout [1] Version: 7.x-4.x-dev Date: 2017-November-01 Security risk: *Moderately critical* 14∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Proof/TD:All [2] Vulnerability: Cross Site Scripting Description: This module provides a site administrator the ability to log users out after a specified time of inactivity. It is highly customizable and includes "site policies" by role to enforce log out. The module does not sufficiently filter user-supplied text that is stored in the configuration, resulting in a persistent Cross Site Scripting vulnerability (XSS). This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer autologout". Solution: Install the latest version: * If you use the Automated Logout module for Drupal 7, upgrade to Automated Logout 7.x-4.5 [3] Reported By: * Nancy Wichmann [4] Fixed By: * Nancy Wichmann [5] * Ajit Shinde [6] the module maintainer Coordinated By: * David Snopek [7] of the Drupal Security Team [1] https://www.drupal.org/project/autologout [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/autologout/releases/7.x-4.5 [4] https://www.drupal.org/u/nancydru [5] https://www.drupal.org/u/nancydru [6] https://www.drupal.org/u/ajits [7] https://www.drupal.org/user/u/dsnopek

1 0

Mosaik - Moderately critical - Cross-site scripting - SA-CONTRIB-2017-080
by security-news＠drupal.org 25 Oct '17

25 Oct '17

View online: https://www.drupal.org/sa-contrib-2017-080 Project: Mosaik [1] Version: 7.x-1.x-dev Date: 2017-October-25 Security risk: *Moderately critical* 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross-site scripting Description: The Mosaik module enables you to create pages or complex blocks in Drupal with the logic of a real mosaic and its pieces. The module doesn't sufficiently sanitize the titles of fieldsets on its administration pages or the titles of blocks that it creates. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer mosaik". Solution: Install the latest version: * If you use the Mosaik module for Drupal 7, upgrade to Mosaik 7.x-1.2 [3] Also see the Mosaik [4] project page. Reported By: * Tatar Balazs Janos [5] Fixed By: * Tatar Balazs Janos [6] * Adriano Cori [7], the module maintainer Coordinated By: * David Rothstein [8] of the Drupal Security Team [1] https://www.drupal.org/project/mosaik [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/mosaik/releases/7.x-1.2 [4] https://www.drupal.org/project/mosaik [5] https://www.drupal.org/u/tatarbj [6] https://www.drupal.org/u/tatarbj [7] https://www.drupal.org/user/805228 [8] https://www.drupal.org/user/124982

1 0

Brilliant Gallery - Highly critical - Multiple Vulnerabilities - SA-CONTRIB-2017-079
by security-news＠drupal.org 25 Oct '17

25 Oct '17

View online: https://www.drupal.org/sa-contrib-2017-079 Project: Brilliant Gallery [1] Version: 7.x-1.x-dev Date: 2017-October-25 Security risk: *Highly critical* 20∕25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Multiple Vulnerabilities Description: This module enables you to display any number of galleries based on images located in the files folder. The module doesn't sufficiently sanitize various database queries which may allow attackers to craft requests resulting in an SQL injection vulnerability. This vulnerability could be exploited even by anonymous users and could potentially allow them to take over the site. The module doesn't sufficiently confirm a user's intent to save checklist data, which allows for a cross-site request forgery (CSRF) exploit to be executed by unprivileged users. Some configuration fields are not filtered while rendered, resulting in a cross-site scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer Brilliant Gallery". Solution: Install the latest version: * If you use the Brilliant Gallery module for Drupal 7, upgrade to Brilliant Gallery 7.x-1.10 [3] Reported By: * Jean-François Hovinne [4] Fixed By: * Tomas Fulopp [5], the module maintainer Coordinated By: * Greg Knaddison [6] of the Drupal Security Team [1] https://www.drupal.org/project/brilliant_gallery [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/brilliant_gallery/releases/7.x-1.10 [4] https://www.drupal.org/u/jfhovinne [5] https://www.drupal.org/u/vacilando [6] https://www.drupal.org/u/greggles

1 0

Yandex.Metrics - Moderately critical - Cross site scripting - SA-CONTRIB-2017-78
by security-news＠drupal.org 18 Oct '17

18 Oct '17

View online: https://www.drupal.org/sa-contrib-2017-78 Project: Yandex.Metrics [1] Version: 7.x-3.x-dev7.x-2.x-dev7.x-1.x-dev Date: 2017-October-18 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross site scripting Description: The Yandex.Metrics module allows you to look for key indicators of your site effectiveness. The module doesn't sufficiently let users know a setting page should not be given to untrusted users. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer Yandex.Metrics settings." Solution: Install the latest version: * If you use the Yandex.Metrics module for Drupal 7.x, upgrade to its 7.x-3.1 [3] Also see the Yandex.Metrics [4] project page. Reported By: * Tatar Balazs Janos [5] Fixed By: * Tatar Balazs Janos [6] * Konstantin Komelin [7] the module maintainer Coordinated By: * Michael Hess [8] of the Drupal Security Team * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/yandex_metrics [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/yandex_metrics/releases/7.x-3.1 [4] https://www.drupal.org/project/yandex_metrics [5] https://www.drupal.org/u/tatarbj [6] https://www.drupal.org/u/tatarbj [7] https://www.drupal.org/user/1195752 [8] https://www.drupal.org/u/mlhess [9] https://www.drupal.org/u/greggles

1 0

netFORUM Authentication - Moderately critical - Access Bypass - SA-CONTRIB-2017-077
by security-news＠drupal.org 11 Oct '17

11 Oct '17

View online: https://www.drupal.org/node/2915530 Project: netFORUM Authentication [1] Version: 7.x-1.0 Date: 2017-October-11 Security risk: *Moderately critical* 12∕25 AC:None/A:None/CI:None/II:None/E:Theoretical/TD:All [2] Vulnerability: Access Bypass Description: The netFORUM Authentication module implements external authentication for users against netFORUM. The module does not correctly use flood control making it susceptible to brute force attacks. Solution: Install the latest version: * If you use the netFORUM Authentication module for Drupal 7.x, upgrade to netFORUM Authentication 7.x-1.1 [3] Reported By: * William Hurley [4] Coordinated By: * Cash Williams [5] of the Drupal Security Team Fixed By: * William Hurley [6] [1] https://www.drupal.org/project/netforum_authentication [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/netforum_authentication/releases/7.x-1.1 [4] https://www.drupal.org/user/wwhurley [5] https://www.drupal.org/u/cashwilliams [6] https://www.drupal.org/u/wwhurley

1 0

Skype Status - Moderately Critical - Cross Site Scripting - DRUPAL-SA-CONTRIB-2017-076
by security-news＠drupal.org 20 Sep '17

20 Sep '17

View online: https://www.drupal.org/node/2910308 * Advisory ID: DRUPAL-SA-CONTRIB-2017-076 * Project: Skype Status [1] (third-party module) * Version: 7.x * Date: 2017-September-20 * Security risk: 14/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module enables you to obtain the status for a user's Skype account The module doesn't sufficiently sanitize the user input for their Skype ID. This vulnerability is mitigated by the fact that an attacker must have an account on the site and be allowed to edit/input their Skype ID. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Skype Status (skype_status) 7.x-2.x versions prior to 7.x-1.2. Drupal core is not affected. If you do not use the contributed Skype Status [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Skype Status (skype_status) module for Drupal 7.x, upgrade to Skype Status (skype_status) 7.x-1.2 [5]. Also see the Skype Status [6] project page. -------- REPORTED BY --------------------------------------------------------- * Tatár Balázs János (tatarbj) [7]. -------- FIXED BY ------------------------------------------------------------ * Tatár Balázs János (tatarbj) [8] provided patch. * Nicholas Alipaz (nicholasalipaz) [9] the module maintainer. -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [15] [1] https://www.drupal.org/project/skype_status [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/skype_status [5] https://www.drupal.org/project/skype_status/releases/7.x-1.2 [6] https://www.drupal.org/project/skype_status [7] https://www.drupal.org/user/649590 [8] https://www.drupal.org/user/649590 [9] https://www.drupal.org/u/nicholasalipaz [10] https://www.drupal.org/u/mlhess [11] https://www.drupal.org/contact [12] https://www.drupal.org/security-team [13] https://www.drupal.org/writing-secure-code [14] https://www.drupal.org/security/secure-configuration [15] https://twitter.com/drupalsecurity

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news