- Security-news - lists.drupal.org

Views Send - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-061
by security-news＠drupal.org 09 Nov '16

09 Nov '16

View online: https://www.drupal.org/node/2826155 * Advisory ID: DRUPAL-SA-CONTRIB-2016-061 * Project: Views Send [1] (third-party module) * Version: 7.x * Date: 2016-November-09 * Security risk: 13/25 ( Moderately Critical) AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Views Send module enables you to send mail to multiple users from a View. The module doesn't sufficiently filter potential user-supplied data when previewing the e-mail which can lead to a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "mass mailing with views_send". -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Views Send 7.x-1.x versions prior to 7.x-1.3. Drupal core is not affected. If you do not use the contributed Views Send [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Views Send module for Drupal 7.x, upgrade to Views Send 7.x-1.3 [5] Also see the Views Send [6] project page. -------- REPORTED BY --------------------------------------------------------- * A RICHARD [7] -------- FIXED BY ------------------------------------------------------------ * Hans Fredrik Nordhaug [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * David Snopek [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [14] [1] https://www.drupal.org/project/views_send [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/views_send [5] https://www.drupal.org/project/views_send/releases/7.x-1.3 [6] https://www.drupal.org/project/views_send [7] https://www.drupal.org/user/3240053 [8] https://www.drupal.org/user/40521 [9] https://www.drupal.org/u/dsnopek [10] https://www.drupal.org/contact [11] https://www.drupal.org/security-team [12] https://www.drupal.org/writing-secure-code [13] https://www.drupal.org/security/secure-configuration [14] https://twitter.com/drupalsecurity

1 0

Workbench Moderation - Moderately Critical - Information Disclosure - SA-CONTRIB-2016-060
by security-news＠drupal.org 02 Nov '16

02 Nov '16

View online: https://www.drupal.org/node/2824455 * Advisory ID: DRUPAL-SA-CONTRIB-2016-060 * Project: Workbench Moderation [1] (third-party module) * Version: 7.x * Date: 2016-November-02 * Security risk: 11/25 ( Moderately Critical) AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Uncommon [2] * Vulnerability: Information Disclosure -------- DESCRIPTION --------------------------------------------------------- This module enables you to create and manage custom editorial workflows around a site's content. The module could result in unpublished content being temporarily made visible via content lists, e.g. as generated by Views, when its editorial status was being changed, e.g. from "draft" to "needs work". This vulnerability is mitigated by the fact that the content lists must be regenerated at exactly the moment when a person saves the node. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Workbench Moderation 7.x-1.x versions and 7.x-3.x versions prior to 7.x-3.0. Drupal core is not affected. If you do not use the contributed Workbench Moderation [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Workbench Moderation module for Drupal 7.x, upgrade to Workbench Moderation 7.x-3.0. [5] Also see the Workbench Moderation [6] project page. -------- REPORTED BY --------------------------------------------------------- * Colin Smith [7]. -------- FIXED BY ------------------------------------------------------------ * Steve Persch [8], a module comaintainer. * Larry Garfield [9], a module comaintainer. * Ken Rickard [10], a module comaintainer. * Peter Philipp [11], a module comaintainer. * Damien McKenna [12] of the Drupal Security Team. -------- COORDINATED BY ------------------------------------------------------ * The Drupal Security Team. -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [13]. Learn more about the Drupal Security team and their policies [14], writing secure code for Drupal [15], and securing your site [16]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [17] [1] https://www.drupal.org/project/workbench_moderation [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/workbench_moderation [5] https://www.drupal.org/project/workbench_moderation/releases/7.x-3.0 [6] https://www.drupal.org/project/workbench_moderation [7] https://www.drupal.org/user/3067047 [8] https://www.drupal.org/u/stevector [9] https://www.drupal.org/u/crell [10] https://www.drupal.org/u/agentrickard [11] https://www.drupal.org/u/das-peter [12] https://www.drupal.org/u/damienmckenna [13] https://www.drupal.org/contact [14] https://www.drupal.org/security-team [15] https://www.drupal.org/writing-secure-code [16] https://www.drupal.org/security/secure-configuration [17] https://twitter.com/drupalsecurity

1 0

D8 Editor File upload - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-059
by security-news＠drupal.org 02 Nov '16

02 Nov '16

View online: https://www.drupal.org/node/2824436 * Advisory ID: DRUPAL-SA-CONTRIB-2016-059 * Project: D8 Editor File upload [1] (third-party module) * Version: 8.x * Date: 2016-November-02 * Security risk: 12/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon [2] * Vulnerability: -------- DESCRIPTION --------------------------------------------------------- This module enables you to upload files directly within the CKEditor and create a link to download the given file. The module doesn't sufficiently check the uploaded file extensions when the allowed extensions list is not the default one. This vulnerability is mitigated by the fact that an attacker must have a role with the permission to use a text filter that enables this CKEditor plugin and does not use the default allowed extensions. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * D8 Editor File Upload 8.x-1.x versions prior to 8.x-1.2. Drupal core is not affected. If you do not use the contributed D8 Editor File upload [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the D8 Editor File Upload module for Drupal 8.x, upgrade to D8 Editor File Upload 8.x-1.2 [5] Also see the D8 Editor File upload [6] project page. -------- REPORTED BY --------------------------------------------------------- * Greg Dunlap (heyrocker) [7] of the Drupal Security Team * Tim Hayward (thtas) [8] -------- FIXED BY ------------------------------------------------------------ * Tim Hayward (thtas) [9] * Greg Dunlap (heyrocker) [10] of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * David Snopek [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [16] [1] https://www.drupal.org/project/editor_file [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/editor_file [5] https://www.drupal.org/project/editor_file/releases/8.x-1.2 [6] https://www.drupal.org/project/editor_file [7] https://www.drupal.org/u/heyrocker [8] https://www.drupal.org/u/thtas [9] https://www.drupal.org/u/thtas [10] https://www.drupal.org/u/heyrocker [11] https://www.drupal.org/u/dsnopek [12] https://www.drupal.org/contact [13] https://www.drupal.org/security-team [14] https://www.drupal.org/writing-secure-code [15] https://www.drupal.org/security/secure-configuration [16] https://twitter.com/drupalsecurity

1 0

Bootstrap - ModeratelyCritical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-058
by security-news＠drupal.org 02 Nov '16

02 Nov '16

View online: https://www.drupal.org/node/2824413 * Advisory ID: DRUPAL-SA-CONTRIB-2014-0XX * Project: Bootstrap [1] (third-party theme) * Version: 7.x * Date: 2016-November-02 * Security risk: 13/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- The Bootstrap theme enables you to integrate the Bootstrap framework with Drupal. The theme does not sufficiently filter potential user-supplied data when it's passed to certain templates can which lead to a Persistent Cross Site Scripting (XSS) vulnerability. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Bootstrap 7.x-3.x versions prior to 7.x-3.7 Drupal core is not affected. If you do not use the contributed Bootstrap [4] theme, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Bootstrap theme from the 7.x-3.x branch, upgrade to Bootstrap 7.x-3.8 [5] Also see the Bootstrap [6] project page. -------- REPORTED BY --------------------------------------------------------- * Peter Berryman [7] -------- FIXED BY ------------------------------------------------------------ * Mark Carver [8] the theme maintainer -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [14] [1] https://www.drupal.org/project/bootstrap [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/bootstrap [5] https://www.drupal.org/project/bootstrap/releases/7.x-3.8 [6] https://www.drupal.org/project/bootstrap [7] https://www.drupal.org/user/554130 [8] https://www.drupal.org/u/mark-carver [9] https://www.drupal.org/u/mlhess [10] https://www.drupal.org/contact [11] https://www.drupal.org/security-team [12] https://www.drupal.org/writing-secure-code [13] https://www.drupal.org/security/secure-configuration [14] https://twitter.com/drupalsecurity

1 0

Profile 2 Registration Path - Critical - Unsupported - DRUPAL-SA-CONTRIB-2015-057
by security-news＠drupal.org 02 Nov '16

02 Nov '16

View online: https://www.drupal.org/node/2824407 * Advisory ID: DRUPAL-SA-CONTRIB-2015-057 * Project: Profile2 Registration Path [1] (third-party module) * Version: 7.x * Date: 2016-November-02 * Security risk: 19/25 ( Critical) AC:None/A:None/CI:Some/II:Some/E:Proof/TD:All [2] * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- This module enables administrators to set unique registration paths per Profile2 profile type. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- All versions are affected. Drupal core is not affected. If you do not use the contributed Profile2 Registration Path [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Uninstall the module Also see the Profile2 Registration Path [5] project page. -------- REPORTED BY --------------------------------------------------------- * Will Long [6] -------- FIXED BY ------------------------------------------------------------ N/A -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [7]. Learn more about the Drupal Security team and their policies [8], writing secure code for Drupal [9], and securing your site [10]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [11] [1] https://www.drupal.org/project/profile2_regpath [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/profile2_regpath [5] https://www.drupal.org/project/profile2_regpath [6] https://www.drupal.org/user/1175666 [7] https://www.drupal.org/contact [8] https://www.drupal.org/security-team [9] https://www.drupal.org/writing-secure-code [10] https://www.drupal.org/security/secure-configuration [11] https://twitter.com/drupalsecurity

1 0

Like/Dislike - Critical - Unsupported- SA-CONTRIB-2016-056
by security-news＠drupal.org 02 Nov '16

02 Nov '16

View online: https://www.drupal.org/node/2824406 * Advisory ID: DRUPAL-SA-CONTRIB-2016-056 * Project: Like/Dislike [1] (third-party module) * Version: 7.x * Date: 2016-November-02 * Security risk: 15/25 ( Moderately Critical) AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:All [2] * Cross Site Request Forgery -------- DESCRIPTION --------------------------------------------------------- Like/Dislike module can be used to Like and Dislike actions on any content. It is powered by Drupal field concept. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * All versions of like/dislike module. Drupal core is not affected. If you do not use the contributed Like/Dislike [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ If you use the like/dislike module for Drupal 7.x you should uninstall it. Also see the Like/Dislike [5] project page. -------- REPORTED BY --------------------------------------------------------- * Naveen Valecha [6] -------- FIXED BY ------------------------------------------------------------ Not applicable. -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [7]. Learn more about the Drupal Security team and their policies [8], writing secure code for Drupal [9], and securing your site [10]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [11] [1] https://www.drupal.org/project/like_dislike [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/like_dislike [5] https://www.drupal.org/project/like_dislike [6] https://www.drupal.org/user/2665733 [7] https://www.drupal.org/contact [8] https://www.drupal.org/security-team [9] https://www.drupal.org/writing-secure-code [10] https://www.drupal.org/security/secure-configuration [11] https://twitter.com/drupalsecurity

1 0

Menu Views - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-055
by security-news＠drupal.org 02 Nov '16

02 Nov '16

View online: https://www.drupal.org/node/2824402 * Advisory ID: DRUPAL-SA-CONTRIB-2016-055 * Project: Menu Views [1] (third-party module) * Version: 7.x * Date: 2016-November-02 * Security risk: 12/25 ( Moderately Critical) AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module enables users to create menu items that render views instead of links. This is useful for creating "mega-menus". The module doesn't sufficiently filter title and breadcrumb fields for possible cross-site scripting. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer menu views". -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Menu Views 7.x-2.x versions prior to 7.x-2.4. Drupal core is not affected. If you do not use the contributed Menu Views [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Menu Views module for Drupal 7.x, upgrade to Menu Views 7.x-2.4 [5] Also see the Menu Views [6] project page. -------- REPORTED BY --------------------------------------------------------- * Michael Hess [7] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Ron Shimshock [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [14] [1] https://www.drupal.org/project/menu_views [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/menu_views [5] https://www.drupal.org/project/menu_views/releases/7.x-2.4 [6] https://www.drupal.org/project/menu_views [7] https://www.drupal.org/u/mlhess [8] https://www.drupal.org/u/ron_s [9] https://www.drupal.org/u/mlhess [10] https://www.drupal.org/contact [11] https://www.drupal.org/security-team [12] https://www.drupal.org/writing-secure-code [13] https://www.drupal.org/security/secure-configuration [14] https://twitter.com/drupalsecurity

1 0

Tripal BLAST UI - Highly Critical - Remote Code Execution - SA-CONTRIB-2016-054
by security-news＠drupal.org 26 Oct '16

26 Oct '16

View online: https://www.drupal.org/node/2822366 * Advisory ID: DRUPAL-SA-CONTRIB-2016-054 * Project: Tripal BLAST UI [1] (third-party module) * Version: 7.x * Date: 2016-October-26 * Security risk: 20/25 ( Highly Critical) AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:All [2] * Vulnerability: Remote code execution -------- DESCRIPTION --------------------------------------------------------- This module enables you to run NCBI BLAST jobs on the host system. The module doesn't sufficiently validate advanced options available to users submitting BLAST jobs, thereby exposing the ability to enter a short snippet of shell code that will be executed when the BLAST job is run. This vulnerability only requires the attacker to have minimal permissions on the site (for example, "View published content") and therefore can be exploited by untrusted or unauthenticated users in most cases. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Tripal BLAST UI 7.x-1.x versions prior to 7.x-1.2 Drupal core is not affected. If you do not use the contributed Tripal BLAST UI [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Tripal BLAST UI module for Drupal 7.x, upgrade to Tripal BLAST UI 7.x-1.2 [5] Also see the Tripal BLAST UI [6] project page. -------- REPORTED BY --------------------------------------------------------- * Nick Booher [7] * David Rothstein [8] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Lacey-Anne Sanderson [9] the module maintainer * Nick Booher [10] * David Rothstein [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [16] [1] https://www.drupal.org/project/tripal_blast [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/tripal_blast [5] https://www.drupal.org/project/tripal_blast/releases/7.x-1.2 [6] https://www.drupal.org/project/tripal_blast [7] https://www.drupal.org/user/809346 [8] https://www.drupal.org/user/124982 [9] https://www.drupal.org/user/781094 [10] https://www.drupal.org/user/809346 [11] https://www.drupal.org/user/124982 [12] https://www.drupal.org/contact [13] https://www.drupal.org/security-team [14] https://www.drupal.org/writing-secure-code [15] https://www.drupal.org/security/secure-configuration [16] https://twitter.com/drupalsecurity

1 0

Webform - Less Critical - Access Bypass - SA-CONTRIB-2016-053
by security-news＠drupal.org 19 Oct '16

19 Oct '16

View online: https://www.drupal.org/node/2820444 * Advisory ID: DRUPAL-SA-CONTRIB-2016-053 * Project: Webform [1] (third-party module) * Version: 7.x * Date: 2016-October-19 * Security risk: 9/25 ( Less Critical) AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:Default [2] * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- This module provides a user interface to create and configure forms called Webforms. When using forms with private file uploads, Webform wasn't explicitly denying access to files it managed which could allow access to be granted by other modules. The vulnerability is mitigated by the fact that another module has to explicitly grant access to those files. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Webform 7.x-3.x versions prior to 7.x-3.25. * Webform 7.x-4.x is unaffected. Drupal core is not affected. If you do not use the contributed Webform [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ If you use webform-7.x-3.x you may … * upgrade to webform 7.x-3.25 [5] * upgrade to webform-7.x-4.x but be aware of the backwards incompatible changes [6]. Also see the Webform [7] project page. -------- REPORTED BY --------------------------------------------------------- * DeveloperChris [8] -------- FIXED BY ------------------------------------------------------------ * Dan Chadwick [9] a module maintainer * Roman Zimmermann [10] a module maintainer. -------- COORDINATED BY ------------------------------------------------------ * David Snopek [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [16] [1] https://www.drupal.org/project/webform [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/webform [5] https://www.drupal.org/project/webform/releases/7.x-3.25 [6] https://www.drupal.org/node/1609324 [7] https://www.drupal.org/project/webform [8] https://www.drupal.org/user/2789879 [9] https://www.drupal.org/user/504278 [10] https://www.drupal.org/u/torotil [11] https://www.drupal.org/user/266527 [12] https://www.drupal.org/contact [13] https://www.drupal.org/security-team [14] https://www.drupal.org/writing-secure-code [15] https://www.drupal.org/security/secure-configuration [16] https://twitter.com/drupalsecurity

1 0

Elysia Cron - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2016-052
by security-news＠drupal.org 12 Oct '16

12 Oct '16

View online: https://www.drupal.org/node/2817211 * Advisory ID: DRUPAL-SA-CONTRIB-2016-052 * Project: Elysia Cron [1] (third-party module) * Version: 7.x * Date: 2016-October-12 * Security risk: 11/25 ( Moderately Critical) AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:Default [2] * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module enables you to manage cron jobs. The module doesn't sufficiently sanitize the cron rules which are entered into "Predefined rules" field thereby exposing a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer elysia cron". -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Elysia Cron 7.x-2.x versions prior to 7.x-2.2. Drupal core is not affected. If you do not use the contributed Elysia Cron [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Elysia Cron module for Drupal 7.x, upgrade to Elysia Cron 7.x-2.3 [5] Also see the Elysia Cron [6] project page. -------- REPORTED BY --------------------------------------------------------- * Dan Richards [7] * Michael Hess [8] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Kiselev Dmitry [9] the module co-maintainer -------- COORDINATED BY ------------------------------------------------------ * David Snopek [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [15] [1] https://www.drupal.org/project/elysia_cron [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/elysia_cron [5] https://www.drupal.org/project/elysia_cron/releases/7.x-2.3 [6] https://www.drupal.org/project/elysia_cron [7] https://www.drupal.org/user/3157375 [8] https://www.drupal.org/user/102818 [9] https://www.drupal.org/user/1945174 [10] https://www.drupal.org/user/266527 [11] https://www.drupal.org/contact [12] https://www.drupal.org/security-team [13] https://www.drupal.org/writing-secure-code [14] https://www.drupal.org/security/secure-configuration [15] https://twitter.com/drupalsecurity

1 0