Security-news

security-news@drupal.org

1 participants
1782 discussions

Layout Builder Advanced Permissions - Moderately critical - Access bypass - SA-CONTRIB-2025-097
by security-news＠drupal.org 13 Aug '25

13 Aug '25

View online: https://www.drupal.org/sa-contrib-2025-097 Project: Layout Builder Advanced Permissions [1] Date: 2025-August-13 Security risk: *Moderately critical* 10 ∕ 25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Access bypass Affected versions: 2.2.0 CVE IDs: CVE-2025-8996 Description: The Layout Builder Advanced Permissions module enables you to have fine grained control over who can do what in editing pages built with Layout Builder. The module doesn't sufficiently control access for adding sections in the submodule. This vulnerability is mitigated by the fact that an attacker must have a role with a specific set of permissions: * Node: View published content * Node: (Your content type): Create new content * Node: (Your content type): Edit any content * Layout builder: (Your content type): Configure layout overrides for content items that the user can edit * Layout builder advanced permissions: Access Layout Builder page Solution: Install the latest version: * If you use the Layout Builder Advanced Permissions module, upgrade to Layout Builder Advanced Permissions 2.2.1 [3] Reported By: * Eelke Blok (eelkeblok) [4] * Michael Whittaker (mrwhittaker) [5] Fixed By: * Eelke Blok (eelkeblok) [6] * Sorin Dediu (sdstyles) [7] * Sean Blommaert (seanb) [8] Coordinated By: * Anna Kalata (akalata) [9] * Damien McKenna (damienmckenna) [10] of the Drupal Security Team * Greg Knaddison (greggles) [11] of the Drupal Security Team * Juraj Nemec (poker10) [12] of the Drupal Security Team * Cathy Theys (yesct) [13] of the Drupal Security Team [1] https://www.drupal.org/project/layout_builder_perms [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/layout_builder_perms/releases/2.2.1 [4] https://www.drupal.org/u/eelkeblok [5] https://www.drupal.org/u/mrwhittaker [6] https://www.drupal.org/u/eelkeblok [7] https://www.drupal.org/u/sdstyles [8] https://www.drupal.org/u/seanb [9] https://www.drupal.org/u/akalata [10] https://www.drupal.org/u/damienmckenna [11] https://www.drupal.org/u/greggles [12] https://www.drupal.org/u/poker10 [13] https://www.drupal.org/u/yesct

1 0

Authenticator Login - Highly critical - Access bypass - SA-CONTRIB-2025-096
by security-news＠drupal.org 13 Aug '25

13 Aug '25

View online: https://www.drupal.org/sa-contrib-2025-096 Project: Authenticator Login [1] Date: 2025-August-13 Security risk: *Highly critical* 21 ∕ 25 AC:Basic/A:None/CI:All/II:All/E:Proof/TD:All [2] Vulnerability: Access bypass Affected versions: <2.1.4 CVE IDs: CVE-2025-8995 Description: This module enables users to setup two-factor authentication (2FA) using authenticator apps for enhanced login security. The module alters the standard Drupal login form to use AJAX callbacks for handling authentication flow. The module doesn't sufficiently validate authentication under specific conditions, allowing an attacker to log in as any account where they know the username. This vulnerability is mitigated by the fact that an attacker must make a series of requests to trigger the necessary conditions that allow authentication byass. The series of requests could alert a site owner that they are being attacked; however, the number of requests necessary to trigger the conditions is usually quite small (the number depends on site configuration, by default it is 5). Solution: Install the latest version: * If you use the alogin module for Drupal 10^, upgrade to the latest version or at least Alogin 2.1.5 [3] /Note: the fix is in a tag in git for 2.1.4 however there is no release for that tag. The fix is also in 2.1.5 relase./ Reported By: * Pierre Rudloff (prudloff) [4] Fixed By: * Ahmed Raza (ahmed.raza) [5] Coordinated By: * Damien McKenna (damienmckenna) [6] of the Drupal Security Team * Dan Smith (galooph) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Cathy Theys (yesct) [9] of the Drupal Security Team [1] https://www.drupal.org/project/alogin [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/alogin/releases/2.1.5 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/ahmedraza [6] https://www.drupal.org/u/damienmckenna [7] https://www.drupal.org/u/galooph [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/yesct

1 0

AI SEO Link Advisor - Less critical - Server-side Request Forgery - SA-CONTRIB-2025-095
by security-news＠drupal.org 06 Aug '25

06 Aug '25

View online: https://www.drupal.org/sa-contrib-2025-095 Project: AI SEO Link Advisor [1] Date: 2025-August-06 Security risk: *Less critical* 8 ∕ 25 AC:Basic/A:User/CI:None/II:None/E:Theoretical/TD:All [2] Vulnerability: Server-side Request Forgery Affected versions: <1.0.6 CVE IDs: CVE-2025-8675 Description: This module enables you to provide SEO analysis and recommendations for a given URL. The module doesn't sufficiently sanitize user-supplied URLs, leading to a Server-side request forgery (SSRF) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access seo analyzer". Solution: Install the latest version: * If you use the AI SEO Link Advisor module 1.0.x, upgrade to AI SEO Link Advisor 1.0.6 [3] Reported By: * Alberto Cocchiara (bigbabert) [4] * Conrad Lara (cmlara) [5] Fixed By: * Alberto Cocchiara (bigbabert) [6] * Conrad Lara (cmlara) [7] * Vishal Kadam (vishal.kadam) [8] Coordinated By: * Benji Fisher (benjifisher) [9] of the Drupal Security Team * catch (catch) [10] of the Drupal Security Team * Damien McKenna (damienmckenna) [11] of the Drupal Security Team * Greg Knaddison (greggles) [12] of the Drupal Security Team [1] https://www.drupal.org/project/ai_seo_link_advisor [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/ai_seo_link_advisor/releases/1.0.6 [4] https://www.drupal.org/u/bigbabert [5] https://www.drupal.org/u/cmlara [6] https://www.drupal.org/u/bigbabert [7] https://www.drupal.org/u/cmlara [8] https://www.drupal.org/u/vishalkadam [9] https://www.drupal.org/u/benjifisher [10] https://www.drupal.org/u/catch [11] https://www.drupal.org/u/damienmckenna [12] https://www.drupal.org/u/greggles

1 0

GoogleTag Manager - Moderately critical - Cross-site scripting - SA-CONTRIB-2025-094
by security-news＠drupal.org 30 Jul '25

30 Jul '25

View online: https://www.drupal.org/sa-contrib-2025-094 Project: GoogleTag Manager [1] Date: 2025-July-30 Security risk: *Moderately critical* 11 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross-site scripting Affected versions: <1.10.0 CVE IDs: CVE-2025-8362 Description: This module enables you to integrate Google Tag Manager (GTM) into your Drupal site by allowing administrators to configure and embed GTM container snippets. The module doesn't sufficiently sanitize the GTM container ID under the scenario where a user with the /Administer gtm/ permission enters malicious input into the /GTM-ID/ field. This value is directly inserted into a tag, making the site vulnerable to Cross-site Scripting (XSS) attacks. This vulnerability is mitigated by the fact that an attacker must have a role with the permission /Administer gtm/, and the input field is limited to 20 characters. Solution: Install the latest version: If you use the Google Tag Manager module for Drupal 8.x, upgrade to Google Tag Manager 8.x-1.10 [3]. The new version includes validation to prevent injection and restricts risky inputs. Additionally, site administrators should review which roles have the /Administer gtm/ permission at /admin/people/permissions. Reported By: * Pierre Rudloff (prudloff) [4], provisional member of the Drupal Security Team Fixed By: * Anatoly Politsin (apolitsin) [5] * Pierre Rudloff (prudloff) [6], provisional member of the Drupal Security Team Coordinated By: * Ivo Van Geertruyen (mr.baileys) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team * Jess (xjm) [9] of the Drupal Security Team [1] https://www.drupal.org/project/gtm [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/gtm/releases/8.x-1.10 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/apolitsin [6] https://www.drupal.org/u/prudloff [7] https://www.drupal.org/u/mrbaileys [8] https://www.drupal.org/u/poker10 [9] https://www.drupal.org/u/xjm

1 0

Config Pages - Moderately critical - Access bypass - SA-CONTRIB-2025-093
by security-news＠drupal.org 30 Jul '25

30 Jul '25

View online: https://www.drupal.org/sa-contrib-2025-093 Project: Config Pages [1] Date: 2025-July-30 Security risk: *Moderately critical* 12 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Affected versions: <2.18.0 CVE IDs: CVE-2025-8361 Description: This module enables you to access an edit page for a config page. The module doesn't sufficiently check the access permissions (hook_ENTITY_TYPE_access() wasn't taken into account). This vulnerability is mitigated by the fact that an attacker must have a role with the permission "edit ID config page" and that it only affects sites that have access restricted via the hook_ENTITY_TYPE_access() hook. Solution: Install the latest version: * If you use the Config Pages module, upgrade to Config Pages 8.x-2.18 [3]. Reported By: * Pierre Rudloff (prudloff) [4], provisional member of the Drupal Security Team Fixed By: * Pierre Rudloff (prudloff) [5], provisional member of the Drupal Security Team * Alexander Shumenko (shumer) [6] Coordinated By: * Greg Knaddison (greggles) [7] of the Drupal Security Team * Heine Deelstra (heine) [8] of the Drupal Security Team * Jess (xjm) [9] of the Drupal Security Team [1] https://www.drupal.org/project/config_pages [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/config_pages/releases/8.x-2.18 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/prudloff [6] https://www.drupal.org/u/shumer [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/heine [9] https://www.drupal.org/u/xjm

1 0

COOKiES Consent Management - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-092
by security-news＠drupal.org 23 Jul '25

23 Jul '25

View online: https://www.drupal.org/sa-contrib-2025-092 Project: COOKiES Consent Management [1] Date: 2025-July-23 Security risk: *Moderately critical* 12 ∕ 25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site Scripting Affected versions: <1.2.16 CVE IDs: CVE-2025-8092 Description: This module allows you to manage video media items using the COOKiES module (disabling external video elements). These elements will be enabled again, once the COOKiES banner is accepted. The module doesn't sufficiently check whether to convert "data-src" attributes to "src" when their value might contain malicious content under the scenario, that module specific classes are set on the HTML element. This vulnerability is mitigated by the fact that an attacker must have the correct permissions to have a specific HTML element display for all users, and this HTML element needs to have a specific class set. Solution: Install the latest version: * If you use the COOKiES Video submodule for Drupal upgrade to COOKiES 1.2.16 [3] Reported By: * Pierre Rudloff (prudloff) [4] provisional member of the Drupal Security Team Fixed By: * Joshua Sedler (grevil) [5] * Joachim Feltkamp (jfeltkamp) [6] Coordinated By: * Greg Knaddison (greggles) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team * Pierre Rudloff (prudloff) [9] provisional member of the Drupal Security Team * Cathy Theys (yesct) [10] of the Drupal Security Team [1] https://www.drupal.org/project/cookies [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/cookies/releases/1.2.16 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/grevil [6] https://www.drupal.org/u/jfeltkamp [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/poker10 [9] https://www.drupal.org/u/prudloff [10] https://www.drupal.org/u/yesct

1 0

Real-time SEO for Drupal - Moderately critical - Cross Site Scripting - SA-CONTRIB-2025-091
by security-news＠drupal.org 16 Jul '25

16 Jul '25

View online: https://www.drupal.org/sa-contrib-2025-091 Project: Real-time SEO for Drupal [1] Date: 2025-July-16 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Affected versions: <2.2.0 CVE IDs: CVE-2025-7716 Description: This module enables you to analyze the content that you're authoring for a website. It shows you a preview of what a search result might look like. The module doesn't sufficiently escape the metadata from content while rendering the preview, opening up the possibility of a XSS attack. This vulnerability is mitigated by the fact that an attacker must be able to author content that is analyzed by the Real-Time SEO module. Solution: Install the latest version: * Upgrade to yoast_seo 8.x-2.2 [3]. Reported By: * Pierre Rudloff (prudloff) [4], provisional member of the Drupal Security Team. Fixed By: * Alexander Varwijk (kingdutch) [5] * Pierre Rudloff (prudloff) [6], provisional member of the Drupal Security Team. Coordinated By: * Damien McKenna (damienmckenna) [7] of the Drupal Security Team * Greg Knaddison (greggles) [8] of the Drupal Security Team * Pierre Rudloff (prudloff), provisional member of the Drupal Security Team [9] * Jess (xjm) [10] of the Drupal Security Team [1] https://www.drupal.org/project/yoast_seo [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/yoast_seo/releases/8.x-2.2 [4] https://www.drupal.org/u/prudloff [5] https://www.drupal.org/u/kingdutch [6] https://www.drupal.org/u/prudloff [7] https://www.drupal.org/u/damienmckenna [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/prudloff [10] https://www.drupal.org/u/xjm

1 0

Block Attributes - Moderately critical - Cross-site Scripting - SA-CONTRIB-2025-090
by security-news＠drupal.org 16 Jul '25

16 Jul '25

View online: https://www.drupal.org/sa-contrib-2025-090 Project: Block Attributes [1] Date: 2025-July-16 Security risk: *Moderately critical* 14 ∕ 25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross-site Scripting Affected versions: <1.1.0 || >=2.0.0 <2.0.1 CVE IDs: CVE-2025-7715 Description: This module allows you to define custom attributes for a block. You can specify an attribute name to be added to the block in a predefined format. The module does not sufficiently validate the provided attributes, which makes it possible to insert JavaScript event attributes such as onmouseover, onkeyup, etc. These attributes can execute JavaScript code when the page is rendered, leading to cross-site scripting (XSS) vulnerabilities. This vulnerability is partially mitigated by the requirement to manually add the specific attributes and corresponding JavaScript code to the form after the attribute has been created. Solution: Install the latest version: * If you use the Block Attributes module for Drupal, upgrade to Block Attributes 8.x-1.1 [3] or Block Attributes 2.0.1 [4]. Reported By: * Pierre Rudloff (prudloff) [5] provisional member of the Drupal Security Team Fixed By: * Kostia Bohach (_shy) [6] Coordinated By: * Greg Knaddison (greggles) [7] of the Drupal Security Team * Juraj Nemec (poker10) [8] of the Drupal Security Team * Pierre Rudloff (prudloff), provisional member of the Drupal Security Team [9] * Jess (xjm) [10] of the Drupal Security Team [1] https://www.drupal.org/project/block_attributes [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/block_attributes/releases/8.x-1.1 [4] https://www.drupal.org/project/block_attributes/releases/2.0.1 [5] https://www.drupal.org/u/prudloff [6] https://www.drupal.org/u/_shy [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/poker10 [9] https://www.drupal.org/u/prudloff [10] https://www.drupal.org/u/xjm

1 0

File Download - Moderately critical - Access bypass - SA-CONTRIB-2025-089
by security-news＠drupal.org 16 Jul '25

16 Jul '25

View online: https://www.drupal.org/sa-contrib-2025-089 Project: File Download [1] Date: 2025-July-16 Security risk: *Moderately critical* 13 ∕ 25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: <1.9.0 || >=2.0.0 <2.0.1 CVE IDs: CVE-2025-7717 Description: The File Download enables you to allow users to download file and image entities directly using a custom field formatter. It also provides an optional submodule to count and display file downloads in Views, similar to how the core statistics module tracks content views. The File Download module does not properly validate input when handling file access requests. This can allow users to bypass protections and access private files that should not be publicly available. Solution: Install the latest version: * If you use the File Download module for Drupal 8.x, upgrade to File Download 2.0.1 [3] or File Download 8.x-1.9 [4]. Reported By: * Willem Drupal enthousiast (willempje2) [5] Fixed By: * Shelane French (shelane) [6] * Willem Drupal enthousiast (willempje2) [7] Coordinated By: * Greg Knaddison (greggles) [8] of the Drupal Security Team * Juraj Nemec (poker10) [9] of the Drupal Security Team * Jess (xjm) [10] of the Drupal Security Team [1] https://www.drupal.org/project/file_download [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/file_download/releases/2.0.1 [4] https://www.drupal.org/project/file_download/releases/8.x-1.9 [5] https://www.drupal.org/u/willempje2 [6] https://www.drupal.org/u/shelane [7] https://www.drupal.org/u/willempje2 [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/poker10 [10] https://www.drupal.org/u/xjm

1 0

Mail Login - Critical - Access bypass - SA-CONTRIB-2025-088
by security-news＠drupal.org 09 Jul '25

09 Jul '25

View online: https://www.drupal.org/sa-contrib-2025-088 Project: Mail Login [1] Date: 2025-July-09 Security risk: *Critical* 15 ∕ 25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Access bypass Affected versions: >3.0.0 <3.2.0 || >=4.0.0 <4.2.0 CVE IDs: CVE-2025-7393 Description: This module enables users to login by email address with the minimal configurations. The module included some protection against brute force attacks on the login form, however they were incomplete. An attacker could bypass the brute force protection allowing them to potentially gain access to an account. Solution: Install the latest version: * If you use the mail_login 3.x, upgrade to Mail Login 3.2.0 [3] * If you use the mail_login 4.x, upgrade to Mail Login 4.2.0 [4] Reported By: * Ryugo Kinoshita (dc-kinoshita) [5] Fixed By: * Damien McKenna (damienmckenna) [6] of the Drupal Security Team * Mohammad AlQanneh (mqanneh) [7] Coordinated By: * Greg Knaddison (greggles) [8] of the Drupal Security Team [1] https://www.drupal.org/project/mail_login [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/mail_login/releases/3.2.0 [4] https://www.drupal.org/project/mail_login/releases/4.2.0 [5] https://www.drupal.org/u/dc-kinoshita [6] https://www.drupal.org/u/damienmckenna [7] https://www.drupal.org/u/mqanneh [8] https://www.drupal.org/u/greggles

1 0

← Newer
1
...
5
6
7
8
9
10
11
...
179
Older →

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news