- Security-news - lists.drupal.org

Dynamic Banner - Critical - Module Unsupported - SA-CONTRIB-2018-011
by security-news＠drupal.org 14 Feb '18

14 Feb '18

View online: https://www.drupal.org/sa-contrib-2018-011 Project: Dynamic Banner [1] Date: 2018-February-14 Security risk: *Critical* 18∕25 AC:None/A:None/CI:Some/II:Some/E:Proof/TD:Default [2] Vulnerability: Module Unsupported Description: Dynamic Banner is a module that lightens the load on web developers from creating many blocks for pages with different banners. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466 [3] Solution: Uninstall the module Reported By: * Balazs Janos Tatar [4]Provisional Security Team Member Fixed By: N/A Coordinated By: N/A [1] https://www.drupal.org/project/dynamic_banner [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466 [4] https://www.drupal.org/user/649590

1 0

Custom Permissions - Moderately critical - Access bypass - SA-CONTRIB-2018-010
by security-news＠drupal.org 14 Feb '18

14 Feb '18

View online: https://www.drupal.org/sa-contrib-2018-010 Project: Custom Permissions [1] Version: 7.x-2.x-dev Date: 2018-February-14 Security risk: *Moderately critical* 14∕25 AC:None/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] Vulnerability: Access bypass Description: This module enables the user to set custom permissions per path. The module doesn't perform sufficient checks on paths with dynamic arguments (like "node/1" or "user/2"), thereby allowing the site administrator to save custom permissions for paths that won't be protected. This could lead to an access bypass vulnerability if the site is relying on the Custom Permissions module to protect those paths. This vulnerability is mitigated by the fact that it only occurs on sites which attempted to use the Custom Permissions module to protect dynamic paths. Solution: Install the latest version: * If you use the Custom Permissions module for Drupal 7.x, upgrade to Custom Permissions 7.x-2.2 [3] After installing the latest version, visit Administration → People → Custom Permissions (admin/people/custom_permissions) and save the form. If it saves with no errors, your site is not vulnerable. However, if an error message is displayed informing you that the module is attempting to protect paths with dynamic arguments that it is unable to protect, your site requires a manual fix; you should reconfigure the site to use a different method to protect these paths (for example, use "node/*" to protect all nodes with the same permission, rather than "node/1" to try to protect only a specific node; or, alternatively, use a node access module to protect the node-related paths with fine-grained access control). Reported By: * David Rothstein [4] of the Drupal Security Team Fixed By: * David Rothstein [5] of the Drupal Security Team * David Valdez [6] the module maintainer Coordinated By: * David Rothstein [7] of the Drupal Security Team [1] https://www.drupal.org/project/config_perms [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/config_perms/releases/7.x-2.2 [4] https://www.drupal.org/user/124982 [5] https://www.drupal.org/user/124982 [6] https://www.drupal.org/user/992990 [7] https://www.drupal.org/user/124982

1 0

VChess - Critical - Module Unsupported - SA-CONTRIB-2018-009
by security-news＠drupal.org 14 Feb '18

14 Feb '18

View online: https://www.drupal.org/sa-contrib-2018-009 Project: VChess [1] Date: 2018-February-14 Security risk: *Critical* 18∕25 AC:None/A:None/CI:Some/II:Some/E:Proof/TD:Default [2] Vulnerability: Module Unsupported Description: The Drupal VChess module allows users to play a chess game. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. If you would like to maintain this module, please read: https://www.drupal.org/node/251466 [3] Solution: Uninstall the module. Reported By: * Daniel Wehner [4] Fixed By: N/A Coordinated By: N/A [1] https://www.drupal.org/project/vchess [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466 [4] https://www.drupal.org/user/99340

1 0

Entity Reference Tab / Accordion Formatter - Moderately critical - Cross Site Scripting - SA-CONTRIB-2018-008
by security-news＠drupal.org 07 Feb '18

07 Feb '18

View online: https://www.drupal.org/sa-contrib-2018-008 Project: Entity Reference Tab / Accordion Formatter [1] Date: 2018-February-07 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: This module enables you to show referenced entities in tabs. The module doesn't sufficiently sanitize the body fields of the referenced entities when it prints them to the tabs. This vulnerability is mitigated by the fact that an attacker must have a role with the permission create/edit content of the content type that is referenced. Solution: Install the latest version: * If you use the Entity Reference Tab / Accordion Formatter module for Drupal 8.x, upgrade to 8.x-1.3 [3] Reported By: * Tatar Balazs Janos [4] Provisional Security Team member Fixed By: * Tatar Balazs Janos [5] Provisional Security Team member * Rakesh James [6] the module maintainer Coordinated By: * Tatar Balazs Janos [7] Provisional Security Team member [1] https://www.drupal.org/project/entity_ref_tab_formatter [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/entity_ref_tab_formatter/releases/8.x-1.3 [4] https://www.drupal.org/u/tatarbj [5] https://www.drupal.org/u/tatarbj [6] https://www.drupal.org/user/1177822 [7] https://www.drupal.org/u/tatarbj

1 0

FileField Sources - Moderately critical - Information Disclosure - SA-CONTRIB-2018-007
by security-news＠drupal.org 07 Feb '18

07 Feb '18

View online: https://www.drupal.org/sa-contrib-2018-007 Project: FileField Sources [1] Date: 2018-February-07 Security risk: *Moderately critical* 12∕25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Information Disclosure Description: This module enables you to upload files to fields via several sources. The module doesn't sufficiently handle access control under the scenario of the autocomplete path of reference sources. Solution: Install the latest version: * If you use the filefield_sources module provided reference source for Drupal 7.x, upgrade to 7.x-1.11. [3] Reported By: * Tatar Balazs Janos [4] Provisional Security Team member Fixed By: * Tatar Balazs Janos [5] Provisional Security Team member * Nate Lampton [6] the module maintainer Coordinated By: * Michael Hess [7] of the Drupal Security Team [1] https://www.drupal.org/project/filefield_sources [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/filefield_sources/releases/7.x-1.11 [4] https://www.drupal.org/u/tatarbj [5] https://www.drupal.org/u/tatarbj [6] https://www.drupal.org/user/35821 [7] https://www.drupal.org/u/mlhess

1 0

Taxonomy Term Reference Tree Widget - Moderately critical - Cross Site Scripting - SA-CONTRIB-2018-006
by security-news＠drupal.org 31 Jan '18

31 Jan '18

View online: https://www.drupal.org/sa-contrib-2018-006 Project: Taxonomy Term Reference Tree Widget [1] Date: 2018-January-31 Security risk: *Moderately critical* 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting Description: This module provides an expandable tree widget for the Taxonomy Term Reference field in Drupal 7. The module doesn't sufficiently sanitize the output of its own defined field formatter. This vulnerability is mitigated by the fact that an attacker must have a role with the permission that allows to edit terms of a taxonomy where the module handles its output. Solution: Install the latest version: * If you use the Taxonomy Term Reference Tree Widget module for Drupal 7.x, upgrade to its 7.x-1.11 [3] Reported By: * Tatar Balazs Janos [4] Fixed By: * Tatar Balazs Janos [5] * Sumit Madan [6] the module maintainer Coordinated By: * Stella Power [7] of the Drupal Security Team [1] https://www.drupal.org/project/term_reference_tree [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/term_reference_tree/releases/7.x-1.11 [4] https://www.drupal.org/u/tatarbj [5] https://www.drupal.org/u/tatarbj [6] https://www.drupal.org/user/1538790 [7] https://www.drupal.org/u/stella

1 0

Sagepay - Critical - Access Bypass - SA-CONTRIB-2018-005
by security-news＠drupal.org 31 Jan '18

31 Jan '18

View online: https://www.drupal.org/sa-contrib-2018-005 Project: Sagepay [1] Version: 7.x-1.4 Date: 2018-January-31 Security risk: *Critical* 15∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] Vulnerability: Access Bypass Description: This module integrates the Sagepay payment service. Some of the URLs used while processing the payment are not sufficiently secured. This might allow attackers to resume a previously failed payment attempt or to view content that should only be shown after a succesful payment. This affects all payments in a Drupal installation with this module enabled (including payments made using other payment methods). Solution: Install the latest version: * If you use the sagepay_paymet module for Drupal 7.x, upgrade to sagepay_payment 7.x-1.5 [3] Also see the Sagepay [4] project page. Reported By: * Roman Zimmermann [5] Fixed By: * Roman Zimmermann [6] Coordinated By: * Greg Knaddison [7] of the Drupal Security Team [1] https://www.drupal.org/project/sagepay_payment [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/sagepay_payment/releases/7.x-1.5 [4] https://www.drupal.org/project/sagepay_payment [5] https://www.drupal.org/u/torotil [6] https://www.drupal.org/u/torotil [7] https://www.drupal.org/u/greggles

1 0

Backup and Migrate - Critical - Arbitrary PHP code execution - SA-CONTRIB-2018-004
by security-news＠drupal.org 24 Jan '18

24 Jan '18

View online: https://www.drupal.org/sa-contrib-2018-004 Project: Backup and Migrate [1] Date: 2018-January-24 Security risk: *Critical* 15∕25 AC:Basic/A:User/CI:Some/II:All/E:Theoretical/TD:Default [2] Vulnerability: Arbitrary PHP code execution Description: This module enables you to create manual and scheduled backups of a site, and restore the site from backup. The module doesn't sufficiently identify that its custom permissions are risky and should only be granted to highly trusted roles. Sites using this module should review the permissions page to verify only trusted users are granted permissions defined by the module. Solution: Install the latest version: * If you use the Backup and Migrate module for Drupal 7.x, upgrade to Backup and Migrate 7.x-3.4 [3]. Reported By: * John Bickar [4] * Cash Williams [5] of the Drupal Security Team. Fixed By: * Damien McKenna [6] the module maintainer. * Daniel Pickering [7] the module maintainer. * Pere Orga [8] of the Drupal Security Team. Coordinated By: * Damien McKenna [9] of the Drupal Security Team. [1] https://www.drupal.org/project/backup_migrate [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/backup_migrate/releases/7.x-3.4 [4] https://www.drupal.org/u/john-bickar [5] https://www.drupal.org/u/cashwilliams [6] https://www.drupal.org/u/damienmckenna [7] https://www.drupal.org/u/ikit-claw [8] https://www.drupal.org/u/pere-orga [9] https://www.drupal.org/u/damienmckenna

1 0

Bible - Critical - Multiple Vulnerabilities - SA-CONTRIB-2018-003
by security-news＠drupal.org 17 Jan '18

17 Jan '18

View online: https://www.drupal.org/sa-contrib-2018-003 Project: Bible [1] Date: 2018-January-17 Security risk: *Critical* 17∕25 AC:Basic/A:User/CI:Some/II:All/E:Proof/TD:All [2] Vulnerability: Multiple Vulnerabilities Description: This module enables you to display a Bible on your website. Users can associate notes with a Bible version. This module has a vulnerability that would allow an attacker to wipe out, update or read notes from other users with a carefully crafted title. A user must have the "Access Bible content" privilege, which is most likely the default if you have enabled this module. The code appeared to allow other SQL injection vulnerabilities as well. Many lines of code were rewritten to make this module more secure. Therefore, even if you did not give users the "Access Bible content" privilege, there may have been other SQL vulnerabilities which could have been exploited. Solution: Install the latest version: * If you use the Bible module for Drupal 7.x, upgrade to Bible 7.x-1.7 [3] Reported By: * jfhovinne [4] Fixed By: * Berend de Boer [5] the module maintainer * László Csécsy (Boobaa) [6] the module maintainer Coordinated By: * Michael Hess [7] of the Drupal Security Team [1] https://www.drupal.org/project/bible [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/bible/releases/7.x-1.7 [4] https://www.drupal.org/user/77723 [5] https://www.drupal.org/user/143552 [6] https://www.drupal.org/user/199303 [7] https://www.drupal.org/u/mlhess

1 0

Node View Permissions - Moderately critical - Access Bypass - SA-CONTRIB-2018-002
by security-news＠drupal.org 10 Jan '18

10 Jan '18

View online: https://www.drupal.org/sa-contrib-2018-002 Project: Node View Permissions [1] Version: 8.x-1.x-dev7.x-1.x-dev Date: 2018-January-10 Security risk: *Moderately critical* 14∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access Bypass Description: The Node view permissions module enables the "View own content" and "View any content" permissions for each content type on the permissions page. This module has a vulnerability that allows users with these permissions to view unpublished content that they are not otherwise authorized to view. * This issue was fixed by the maintainer outside of the normal security team protocols. Some issues were patched in 2014 for the 7.x version of this module. The 8.x release was updated within the last 6 months. Both are now flagged as security updates.* Solution: Install the latest version: * If you use the Node View Permissions module for Drupal 7.x, upgrade to Node View Permissions 7.x-1.5 [3] or higher. * If you use the Node View Permissions module for Drupal 8.x, upgrade to Node View Permissions 8.x-1.1 [4] or higher. Reported By: * Heikki Kesa [5] Fixed By: * The module maintainer Coordinated By: * David Rothstein [6] Of the Drupal Security Team [1] https://www.drupal.org/project/node_view_permissions [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/node_view_permissions/releases/7.x-1.5 [4] https://www.drupal.org/project/node_view_permissions/releases/8.x-1.1 [5] https://www.drupal.org/u/heikki [6] https://www.drupal.org/u/david_rothstein

1 0