- Security-news - lists.drupal.org

Stacks - Critical - Arbitrary PHP code execution - SA-CONTRIB-2018-001
by security-news＠drupal.org 10 Jan '18

10 Jan '18

View online: https://www.drupal.org/sa-contrib-2018-001 Project: Stacks [1] Date: 2018-January-10 Security risk: *Critical* 18∕25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Arbitrary PHP code execution Description: This module enables content editors to create complex pages and layouts on the fly without the help from a developer, using reusable widgets. The module does not sufficiently filter values posted to its AJAX endpoint, which leads to the instantiation of an arbitrary PHP class. This vulnerability is mitigated by the fact that only sites with the Stacks - Content Feed submodule enabled are affected. Solution: Install the latest version: * If you use the Stacks module for Drupal 8.x, upgrade to Stacks 8.x-1.1 [3] Reported By: * Jean-François Hovinne [4] Fixed By: * Mauro Vigliotti [5] the module maintainer Coordinated By: * Michael Hess [6] of the Drupal Security Team [1] https://www.drupal.org/project/stacks [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/stacks/releases/8.x-1.1 [4] https://www.drupal.org/user/77723 [5] https://www.drupal.org/user/176620 [6] https://www.drupal.org/u/mlhess

1 0

me aliases - Highly critical - Arbitrary code execution - SA-CONTRIB-2017-097
by security-news＠drupal.org 20 Dec '17

20 Dec '17

View online: https://www.drupal.org/sa-contrib-2017-097 Project: me aliases [1] Date: 2017-December-20 Security risk: *Highly critical* 20∕25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Arbitrary code execution Description: 'me' module provides shortcut paths to current user's pages, eg user/me, blog/me, user/me/edit, tracker/me etc. The way 'me' module handles URL arguments allows an attacker to execute arbitrary code strings. Solution: Install the latest version: * If you use the 'me' module for Drupal 7.x, upgrade to 'me' 7.x-1.3 [3] Reported By: * ross.linscott [4] Fixed By: * Camilo Bravo [5] * nohup [6] * Michael Hess [7] of the Drupal Security Team Coordinated By: * Michael Hess [8] of the Drupal Security Team [1] https://www.drupal.org/project/me [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/me/releases/7.x-1.3 [4] https://www.drupal.org/user/3544915 [5] https://www.drupal.org/u/cambraca [6] https://www.drupal.org/u/nohup [7] https://www.drupal.org/user/102818 [8] https://www.drupal.org/user/102818

1 0

Directory based organisational layer - Critical - Unsupported - SA-CONTRIB-2017-096
by security-news＠drupal.org 20 Dec '17

20 Dec '17

View online: https://www.drupal.org/sa-contrib-2017-096 Project: Directory based organisational layer [1] Date: 2017-December-20 Security risk: *Critical* 18∕25 AC:None/A:None/CI:Some/II:Some/E:Proof/TD:Default [2] Vulnerability: Unsupported Description: This module adds a new organizational layer to Drupal, making it easy for managing large numbers of files and nodes. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. The security team takes action in cases like this without regard to the severity of the security issue in question. If you would like to maintain this module, please read: https://www.drupal.org/node/251466 [3] All projects that are being marked unsupported are given a score of critical. Code that is no longer maintained poses a threat to securing sites. Solution: If you use the Directory based organisational layer tag module for Drupal you should uninstall it. Reported By: Jean-Francois Hovinne [4] Fixed By: N/A [1] https://www.drupal.org/project/odir [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466 [4] https://www.drupal.org/u/jfhovinne

1 0

ComScore direct tag - Critical - Unsupported - SA-CONTRIB-2017-095
by security-news＠drupal.org 20 Dec '17

20 Dec '17

View online: https://www.drupal.org/sa-contrib-2017-095 Project: ComScore direct tag [1] Date: 2017-December-20 Security risk: *Critical* 18∕25 AC:None/A:None/CI:Some/II:Some/E:Proof/TD:Default [2] Vulnerability: Unsupported Description: A simple module to add in the JS for the comScore Direct tag to your Drupal site. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. The security team takes action in cases like this without regard to the severity of the security issue in question. If you would like to maintain this module, please read: https://www.drupal.org/node/251466 [3] All projects that are being marked unsupported are given a score of critical. Code that is no longer maintained poses a threat to securing sites. Solution: If you use the ComScore Direct tag module for Drupal you should uninstall it. Reported By: Balazs Janos Tatar [4] Fixed By: N/A [1] https://www.drupal.org/project/comscore_direct [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466 [4] https://www.drupal.org/u/tatarbj

1 0

Link Click Count - Critical - Unsupported - SA-CONTRIB-2017-094
by security-news＠drupal.org 20 Dec '17

20 Dec '17

View online: https://www.drupal.org/sa-contrib-2017-094 Project: Link Click Count [1] Date: 2017-December-20 Security risk: *Critical* 18∕25 AC:None/A:None/CI:Some/II:Some/E:Proof/TD:Default [2] Vulnerability: Unsupported Description: The Link Click Count module helps you to monitor the traffic to your website by creating link fields. These link fields can be individual links or internal/external links that can be added to the content type. The security team is marking this module unsupported. There is a known security issue with the module that has not been fixed by the maintainer. The security team takes action in cases like this without regard to the severity of the security issue in question. If you would like to maintain this module, please read: https://www.drupal.org/node/251466 [3] All projects that are being marked unsupported are given a score of critical. Code that is no longer maintained poses a threat to securing sites. Solution: If you use the link click count module for Drupal you should uninstall it. Reported By: Karthik Kumar D K [4] Fixed By: N/A [1] https://www.drupal.org/project/link_click_count [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/node/251466 [4] https://www.drupal.org/u/heykarthikwithu

1 0

Panopoly Core - Moderately critical - Cross Site Scripting - SA-CONTRIB-2017-093
by security-news＠drupal.org 13 Dec '17

13 Dec '17

View online: https://www.drupal.org/sa-contrib-2017-093 Project: Panopoly Core [1] Version: 7.x-1.x-dev Date: 2017-December-13 Security risk: *Moderately critical* 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Scripting Description: This module provides common functionality used by other modules in the Panopoly distribution and child distributions, like, Open Atrium. The module doesn't sufficiently filter node titles used in breadcrumbs when the "Append Page Title to Site Breadcrumb" setting is enabled. This vulnerability is mitigated by the fact that an attacker must have a role with the ability to create content. Solution: Install the latest version: * If you use the Panopoly Core module for Drupal 7.x, upgrade to Panopoly Core 7.x-1.49 [3] Reported By: * Brian Osborne [4] Fixed By: * David Snopek [5] the module maintainer * Brian Osborne [6] Coordinated By: * David Snopek [7] of the Drupal Security Team [1] https://www.drupal.org/project/panopoly_core [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/panopoly_core/releases/7.x-1.49 [4] https://www.drupal.org/user/788032 [5] https://www.drupal.org/user/266527 [6] https://www.drupal.org/user/788032 [7] https://www.drupal.org/user/266527

1 0

Node feedback - Moderately critical - Access Bypass - SA-CONTRIB-2017-092
by security-news＠drupal.org 06 Dec '17

06 Dec '17

View online: https://www.drupal.org/sa-contrib-2017-092 Project: Node feedback [1] Version: 7.x-1.2 Date: 2017-December-06 Security risk: *Moderately critical* 12∕25 AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:Default [2] Vulnerability: Access Bypass Description: This module enables you to set nodes to send feedbacks by personal/site wide contact forms. The module doesn't sufficiently handle the access to nodes whose titles will be shown on contact forms. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Use the site-wide contact form" or "Use users' personal contact forms" which is often assigned to untrusted user roles such as anonymous. Solution: Install the latest version: * If you use the node feedback module for Drupal 7, upgrade to node feedback 7.x-1.3 [3] Also see the Node feedback [4] project page. Reported By: * Tatar Balazs Janos [5] Fixed By: * Tatar Balazs Janos [6] * Bhavin H. Joshi [7] the module maintainer Coordinated By: * Greg Knaddison [8] of the Drupal Security Team * Lee Rowlands [9] of the Drupal Security Team [1] https://www.drupal.org/project/node_feedback [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/node_feedback/releases/7.x-1.3 [4] https://www.drupal.org/project/node_feedback [5] https://www.drupal.org/u/tatarbj [6] https://www.drupal.org/u/tatarbj [7] https://www.drupal.org/user/219482 [8] https://www.drupal.org/u/greggles [9] https://www.drupal.org/u/larowlan

1 0

Configuration Update Manager - Moderately critical - Cross Site Request Forgery (CSRF) - SA-CONTRIB-2017-091
by security-news＠drupal.org 06 Dec '17

06 Dec '17

View online: https://www.drupal.org/sa-contrib-2017-091 Project: Configuration Update Manager [1] Version: 8.x-1.4 Date: 2017-December-06 Security risk: *Moderately critical* 12∕25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Cross Site Request Forgery (CSRF) Description: The Configuration Update Reports sub-module in the Configuration Update module project enables you to run reports to see what configuration on your site differs from the configuration distributed by a module, theme, or installation profile, and to revert, delete, or import configuration. This module doesn't sufficiently protect the Import operation, thereby exposing a Cross Site Request Forgery (CSRF) vulnerability which can be exploited by unprivileged users to trick an administrator into unwanted import of configuration. This vulnerability is mitigated by the fact that only configuration items distributed with a module, theme, or installation profile that is currently installed and enabled on the site can be imported, not arbitrary configuration values. Solution: Install the latest version: * If you use the Configuration Update Manager module and its Reports sub-module for Drupal 8.x, upgrade to Configuration Update Manager version 8.x-1.5 [3] Alternatively, you could remove the permission "import configuration" from all roles on the site, or uninstall the Configuration Update Reports sub-module from your production sites. Also see the Configuration Update Manager [4] project page. Reported By: * Jean-Francois Hovinne [5] Fixed By: * Jennifer Hodgdon [6] the module maintainer Coordinated By: * Greg Knaddison [7] of the Drupal Security Team * Lee Rowlands [8] of the Drupal Security Team [1] https://www.drupal.org/project/config_update [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/config_update/releases/8.x-1.5 [4] https://www.drupal.org/project/config_update [5] https://www.drupal.org/u/jfhovinne [6] https://www.drupal.org/u/jhodgdon [7] https://www.drupal.org/u/greggles [8] https://www.drupal.org/u/larowlan

1 0

Feedback Collect - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2017-090
by security-news＠drupal.org 06 Dec '17

06 Dec '17

View online: https://www.drupal.org/sa-contrib-2017-090 Project: Feedback Collect [1] Version: 7.x-1.5 Date: 2017-December-06 Security risk: *Moderately critical* 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All [2] Vulnerability: Cross Site Scripting (XSS) Description: This module enables you to add feedback forms and gather end user feedback, bug reports or any kind of suggestions. The module doesn't sufficiently filter output of its own fields under the scenario of creating or editing feedback-collect content types. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "create feedback-collect content" or its related editing permissions. Solution: Install the latest version: * If you use the feedback collect module for Drupal 7.x, upgrade to feedback collect 7.x-1.6 [3] Also see the Feedback Collect [4] project page. Reported By: * Tatar Balazs Janos [5] Fixed By: * Tatar Balazs Janos [6] * Jelena Krmar [7] the module maintainer Coordinated By: * Greg Knaddison [8] of the Drupal Security Team [1] https://www.drupal.org/project/feedback_collect [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/feedback_collect/releases/7.x-1.6 [4] https://www.drupal.org/project/feedback_collect [5] https://www.drupal.org/u/tatarbj [6] https://www.drupal.org/u/tatarbj [7] https://www.drupal.org/user/3097287 [8] https://www.drupal.org/u/greggles

1 0

Mailhandler - Critical - Remote Code Execution - SA-CONTRIB-2017-089
by security-news＠drupal.org 06 Dec '17

06 Dec '17

View online: https://www.drupal.org/sa-contrib-2017-089 Project: Mailhandler [1] Version: 7.x-2.10 Date: 2017-December-06 Security risk: *Critical* 17∕25 AC:Complex/A:User/CI:All/II:All/E:Theoretical/TD:All [2] Vulnerability: Remote Code Execution Description: The Mailhandler module enables you to create nodes by email. The Mailhandler module does not validate file attachments. By sending a correctly crafted e-mail to a mailhandler mailbox an attacker can execute arbitrary code. The vulnerability applies to any active mailhandler mailbox, whether or not attachments are mapped to a field. *Mitigating factors:* * For 7.x versions prior to 7.x-2.5, the vulnerability is mitigated by the fact that the 'MailhandlerCommandsFiles' plugin must be enabled. For later versions, the option to disable commands was removed, all commands are enabled in any case. * The vulnerability is mitigated by the fact that the attacker must pass the authentication step. The default authentication is that the attacker must send the crafted e-mail from a registered e-mail address. * The vulnerability is mitigated by the fact that the mailhandler mailbox e-mail address must be known by the attacker. This essentially depends on the usecase, e.g. Mailcomment module. * The vulnerability is mitigated by the fact that the webserver configuration must either permit the execution of some file extensions in the public filesystem or (Apache) has '.htaccess' support enabled through the AllowOverride directive. Solution: Install the latest version: * If you use the Mailhandler module for Drupal 7.x, upgrade to Mailhandler 7.x-2.11 [3] Also see the Mailhandler [4] project page. Reported By: * Marc Darcis [5] Fixed By: * Marc Darcis [6] * Nathaniel Catchpole [7] * Milos Bovan [8] Coordinated By: * Greg Knaddison [9] of the Drupal Security Team [1] https://www.drupal.org/project/mailhandler [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/mailhandler/releases/7.x-2.11 [4] https://www.drupal.org/project/mailhandler [5] https://www.drupal.org/user/3552485 [6] https://www.drupal.org/user/3552485 [7] https://www.drupal.org/user/35733 [8] https://www.drupal.org/u/mbovan [9] https://www.drupal.org/u/greggles

1 0