Security-news

security-news@drupal.org

1 participants
1782 discussions

Administrator Views - Critical - Information Disclosure - SA-CONTRIB-2015-132
by security-news＠drupal.org 08 Jul '15

08 Jul '15

View online: https://www.drupal.org/node/2529378 * Advisory ID: DRUPAL-SA-CONTRIB-2015-132 * Project: Administration Views [1] (third-party module) * Version: 7.x * Date: 2015-July-08 * Security risk: 15/25 ( Critical) AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:All [2] * Vulnerability: Information Disclosure -------- DESCRIPTION --------------------------------------------------------- Administration Views module replaces overview/listing pages with actual views for superior usability. The module does not check access properly under certain circumstances. Anonymous users could get access to read information they should not have access to. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Administration Views 7.x-1.x versions prior to 7.x-1.5. Drupal core is not affected. If you do not use the contributed Administration Views [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Administration Views module for Drupal 7.x, upgrade to Administration Views 7.x-1.5 [5] Also see the Administration Views [6] project page. -------- REPORTED BY --------------------------------------------------------- * Maxim Baev [7] -------- FIXED BY ------------------------------------------------------------ * Damian Lee [8], a module maintainer -------- COORDINATED BY ------------------------------------------------------ * Pere Orga [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [14] [1] https://www.drupal.org/project/admin_views [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/admin_views [5] https://www.drupal.org/node/2529366 [6] https://www.drupal.org/project/admin_views [7] https://www.drupal.org/user/2955009 [8] https://www.drupal.org/u/damiankloip [9] https://www.drupal.org/user/2301194 [10] https://www.drupal.org/contact [11] https://www.drupal.org/security-team [12] https://www.drupal.org/writing-secure-code [13] https://www.drupal.org/security/secure-configuration [14] https://twitter.com/drupalsecurity

1 0

Views Bulk Operations - Moderately critical - Access Bypass - SA-CONTRIB-2015-131
by security-news＠drupal.org 01 Jul '15

01 Jul '15

View online: https://www.drupal.org/node/2516688 * Advisory ID: DRUPAL-SA-CONTRIB-2015-131 * Project: Views Bulk Operations (VBO) [1] (third-party module) * Version: 6.x, 7.x * Date: 2015-July-01 * Security risk: 10/25 ( Moderately Critical) AC:Basic/A:Admin/CI:None/II:All/E:Theoretical/TD:Uncommon [2] * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- The Views Bulk Operations module enables you to add bulk operations to administration views, executing actions on multiple selected rows. The module doesn't sufficiently guard user entities against unauthorized modification. If a user has access to a user account listing view with VBO enabled (such as admin/people when the administration_views module is used), they will be able to edit their own account and give themselves a higher role (such as "administrator") even if they don't have the "'administer users'" permission. This vulnerability is mitigated by the fact that an attacker must have access to such a user listing page and that the bulk operation for changing Roles is enabled. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Views Bulk Operations 7.x-3.x versions prior to 7.x-3.3. * Views Bulk Operations 6.x-1.x versions. Drupal core is not affected. If you do not use the contributed Views Bulk Operations (VBO) [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Views Bulk Operations module for Drupal 7.x, upgrade to Views Bulk Operations 7.x-3.3 [5] * If you use the Views Bulk Operations module for Drupal 6.x, uninstall the module. Also see the Views Bulk Operations (VBO) [6] project page. -------- REPORTED BY --------------------------------------------------------- * Adam Shepherd [7] -------- FIXED BY ------------------------------------------------------------ * Bojan Zivanovic [8] the module maintainer * Adam Shepherd [9] -------- COORDINATED BY ------------------------------------------------------ * Klaus Purer [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [15] [1] https://www.drupal.org/project/views_bulk_operations [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/views_bulk_operations [5] https://www.drupal.org/node/2516680 [6] https://www.drupal.org/project/views_bulk_operations [7] https://www.drupal.org/user/2650563 [8] https://www.drupal.org/user/86106 [9] https://www.drupal.org/user/2650563 [10] https://www.drupal.org/u/klausi [11] https://www.drupal.org/contact [12] https://www.drupal.org/security-team [13] https://www.drupal.org/writing-secure-code [14] https://www.drupal.org/security/secure-configuration [15] https://twitter.com/drupalsecurity

1 0

Migrate - Less critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-130
by security-news＠drupal.org 01 Jul '15

01 Jul '15

View online: https://www.drupal.org/node/2516678 * Advisory ID: DRUPAL-SA-CONTRIB-2015-130 * Project: Migrate [1] (third-party module) * Version: 7.x * Date: 2015-July-01 * Security risk: 8/25 ( Less Critical) AC:Basic/A:Admin/CI:None/II:Some/E:Theoretical/TD:Uncommon [2] * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module enables you to manage migration processes through the administrative UI. The module doesn't sufficiently sanitize destination field labels thereby exposing a Cross Site Scripting vulnerability (XSS). This vulnerability is mitigated by the fact that an attacker must have a role with permission to create/edit fields (such as "administer taxonomy"), or be able to modify source data being imported by an administrator. Furthermore, the migrate_ui submodule must be enabled. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Migrate 7.x-2.x versions prior to 7.x-2.8. Drupal core is not affected. If you do not use the contributed Migrate [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the migrate module's migrate_ui submodule for Drupal 7.x, upgrade to Migrate 7.x-2.8 [5] Also see the Migrate [6] project page. -------- REPORTED BY --------------------------------------------------------- * Benji Fisher [7] -------- FIXED BY ------------------------------------------------------------ * Benji Fisher [8] * Mike Ryan [9], the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Klaus Purer [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [15] [1] https://www.drupal.org/project/migrate [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/migrate [5] https://www.drupal.org/node/2516560 [6] https://www.drupal.org/project/migrate [7] https://www.drupal.org/u/benjifisher [8] https://www.drupal.org/u/benjifisher [9] https://www.drupal.org/user/4420 [10] https://www.drupal.org/u/klausi [11] https://www.drupal.org/contact [12] https://www.drupal.org/security-team [13] https://www.drupal.org/writing-secure-code [14] https://www.drupal.org/security/secure-configuration [15] https://twitter.com/drupalsecurity

1 0

Shibboleth authentication - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-129
by security-news＠drupal.org 24 Jun '15

24 Jun '15

View online: https://www.drupal.org/node/2511518 * Advisory ID: DRUPAL-SA-CONTRIB-2015-129 * Project: Shibboleth authentication [1] (third-party module) * Version: 6.x, 7.x * Date: 2015-June-24 * Security risk: 13/25 ( Moderately Critical) AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:All [2] * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- Shibboleth authentication module allows users to log in and get permissions based on federated (SAML2) authentication. The module didn't filter the text that is displayed as a login link. This vulnerability was mitigated by the fact that an attacker must have a role with the permission /Administer blocks/. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Shibboleth authentication 6.x-4.x versions prior to 6.x-4.2. * Shibboleth authentication 7.x-4.x versions prior to 7.x-4.2. Drupal core is not affected. If you do not use the contributed Shibboleth authentication [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ * If you use the Shibboleth authentication module for Drupal 7.x, upgrade to Shibboleth authentication 7.x-4.2 [5] * If you use the Shibboleth authentication module for Drupal 6.x, upgrade to Shibboleth authentication 6.x-4.2 [6] Also see the Shibboleth authentication [7] project page. -------- REPORTED BY --------------------------------------------------------- * Marcello Cerruti [8] -------- FIXED BY ------------------------------------------------------------ * Kristof Bajnok [9] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Michael Hess [10] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [11]. Learn more about the Drupal Security team and their policies [12], writing secure code for Drupal [13], and securing your site [14]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [15] [1] https://www.drupal.org/project/shib_auth [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/shib_auth [5] https://www.drupal.org/node/2511278 [6] https://www.drupal.org/node/2511280 [7] https://www.drupal.org/project/shib_auth [8] https://www.drupal.org/user/192687 [9] https://www.drupal.org/user/250470 [10] https://www.drupal.org/u/mlhess [11] https://www.drupal.org/contact [12] https://www.drupal.org/security-team [13] https://www.drupal.org/writing-secure-code [14] https://www.drupal.org/security/secure-configuration [15] https://twitter.com/drupalsecurity

1 0

me aliases - Moderately Critical - Open Redirect - SA-CONTRIB-2015-128
by security-news＠drupal.org 24 Jun '15

24 Jun '15

View online: https://www.drupal.org/node/2511424 * Advisory ID: DRUPAL-SA-CONTRIB-2015-128 * Project: me aliases [1] (third-party module) * Version: 6.x, 7.x * Date: 2015-June-24 * Security risk: 11/25 ( Moderately Critical) AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:All [2] * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- 'me aliases' module provides shortcut paths to current user's pages, eg user/me, blog/me, user/me/edit, tracker/me etc. The view user argument handler for the 'me' module has an access bypass vulnerability where it does not check the supplied argument against the current user. This allows any user to access the content served by the view by substituting 'me' in the URL with a user id even when they don't have permission to access the content. These only affects Views which use the Views 'me' user argument handler. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * me aliases 7.x-1.x versions prior to 7.x-1.2 * me aliases 6.x-2.x versions prior to 6.x-2.10 Drupal core is not affected. If you do not use the contributed me aliases [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the 'me aliases' module for Drupal 7.x, upgrade to me 7.x-1.2 [5] * If you use the 'me aliases' module for Drupal 6.x, upgrade to me 6.x-2.10 [6] Also see the me aliases [7] project page. -------- REPORTED BY --------------------------------------------------------- * akosipax [8] -------- FIXED BY ------------------------------------------------------------ * nohup [9] the module maintainer * Stella Power [10] of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * Stella Power [11] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [12]. Learn more about the Drupal Security team and their policies [13], writing secure code for Drupal [14], and securing your site [15]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [16] [1] https://www.drupal.org/project/me [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/me [5] https://www.drupal.org/node/2511386 [6] https://www.drupal.org/node/2511378 [7] https://www.drupal.org/project/me [8] https://www.drupal.org/user/1297728 [9] https://www.drupal.org/user/269763 [10] https://www.drupal.org/user/66894 [11] https://www.drupal.org/user/66894 [12] https://www.drupal.org/contact [13] https://www.drupal.org/security-team [14] https://www.drupal.org/writing-secure-code [15] https://www.drupal.org/security/secure-configuration [16] https://twitter.com/drupalsecurity

1 0

HybridAuth Social Login - Less Critical - Access bypass - SA-CONTRIB-2015-127
by security-news＠drupal.org 24 Jun '15

24 Jun '15

View online: https://www.drupal.org/node/2511410 * Advisory ID: DRUPAL-SA-CONTRIB-2015-127 * Project: HybridAuth Social Login [1] (third-party module) * Version: 7.x * Date: 2015-June-24 * Security risk: 8/25 ( Less Critical) AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:Uncommon [2] * Vulnerability: Access bypass -------- DESCRIPTION --------------------------------------------------------- The HybridAuth Social Login module enables you to allow visitors to authenticate or login to a Drupal site using their identities from social networks like Facebook or Twitter. The module allows account creation through social login when the configuration is set to allow user registration by administrators only. This vulnerability is mitigated by the fact that a site must be configured to allow user registration by administrators only and that authenticated user accounts can access sensitive data that would otherwise not be shown to anonymous users. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * HybridAuth Social Login 7.x-2.x versions prior to 7.x-2.13. Drupal core is not affected. If you do not use the contributed HybridAuth Social Login [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the HybridAuth Social Login module for Drupal 7.x, upgrade to HybridAuth Social Login 7.x-2.13 [5] Also see the HybridAuth Social Login [6] project page. -------- REPORTED BY --------------------------------------------------------- * Tomas Fulopp [7] -------- FIXED BY ------------------------------------------------------------ * Andrew Berezovsky [8] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * Klaus Purer [9] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [10]. Learn more about the Drupal Security team and their policies [11], writing secure code for Drupal [12], and securing your site [13]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [14] [1] https://www.drupal.org/project/hybridauth [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/hybridauth [5] https://www.drupal.org/node/2511200 [6] https://www.drupal.org/project/hybridauth [7] https://www.drupal.org/u/vacilando [8] https://www.drupal.org/u/duozersk [9] https://www.drupal.org/u/klausi [10] https://www.drupal.org/contact [11] https://www.drupal.org/security-team [12] https://www.drupal.org/writing-secure-code [13] https://www.drupal.org/security/secure-configuration [14] https://twitter.com/drupalsecurity

1 0

Camtasia Relay - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-100
by security-news＠drupal.org 17 Jun '15

17 Jun '15

View online: https://www.drupal.org/node/2480241 * Advisory ID: DRUPAL-SA-CONTRIB-2015-100 * Project: Camtasia Relay [1] (third-party module) * Version: 6.x, 7.x * Date: 2015-April-29 * Security risk: 10/25 ( Moderately Critical) AC:Basic/A:User/CI:None/II:None/E:Exploit/TD:Default [2] * Vulnerability: Cross Site Scripting -------- DESCRIPTION --------------------------------------------------------- This module enables you to integrate your Drupal site with TechSmith Relay software. The module doesn't sufficiently sanitize user input under the meta access tab. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "view meta information". -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [3] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * camtasia_relay 6.x-2.x versions prior to 6.x-3.2. * camtasia_relay 7.x-2.x versions prior to 7.x-1.3. Drupal core is not affected. If you do not use the contributed Camtasia Relay [4] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the camtasia_relay module for Drupal 6.x, upgrade to camtasia_relay 6.x-3.2 [5] * If you use the camtasia_relay module for Drupal 7.x, upgrade to camtasia_relay 7.x-1.3 [6] Also see the Camtasia Relay [7] project page. -------- REPORTED BY --------------------------------------------------------- * Owen Barton [8] of the Drupal Security Team * Pere Orga [9] -------- FIXED BY ------------------------------------------------------------ * Nikhil Dubbaka [10] the module maintainer * Aaron Ott [11] of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * Aaron Ott [12] of the Drupal Security Team -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [13]. Learn more about the Drupal Security team and their policies [14], writing secure code for Drupal [15], and securing your site [16]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [17] [1] https://www.drupal.org/project/camtasia_relay [2] https://www.drupal.org/security-team/risk-levels [3] http://cve.mitre.org/ [4] https://www.drupal.org/project/camtasia_relay [5] https://www.drupal.org/node/2480169 [6] https://www.drupal.org/node/2480171 [7] https://www.drupal.org/project/camtasia_relay [8] https://www.drupal.org/user/19668 [9] https://www.drupal.org/user/2301194 [10] https://www.drupal.org/user/372123 [11] https://www.drupal.org/user/154069 [12] https://www.drupal.org/user/154069 [13] https://www.drupal.org/contact [14] https://www.drupal.org/security-team [15] https://www.drupal.org/writing-secure-code [16] https://www.drupal.org/security/secure-configuration [17] https://twitter.com/drupalsecurity

1 0

Content Construction Kit (CCK) - Less Critical - Open Redirect - SA-CONTRIB-2015-126
by security-news＠drupal.org 17 Jun '15

17 Jun '15

View online: https://www.drupal.org/node/2507753 * Advisory ID: DRUPAL-SA-CONTRIB-2015-126 * Project: Content Construction Kit (CCK) [1] (third-party module) * Version: 6.x * Date: 2015-June-17 * Security risk: 9/25 ( Less Critical) AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:Default [2] * Vulnerability: Open Redirect -------- DESCRIPTION --------------------------------------------------------- The Content Construction Kit (CCK) project is a set of modules that allows you to add custom fields to nodes using a web browser. CCK uses a "destinations" query string parameter in URLs to redirect users to new destinations after completing an action on a few administration pages. Under certain circumstances, malicious users can use this parameter to construct a URL that will trick users into being redirected to a 3rd party website, thereby exposing the users to potential social engineering attacks. See also: SA-CORE-2015-002 [3] -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [4] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * Content Construction Kit (CCK) 6.x-2.x versions prior to 6.x-2.10. Drupal core is not affected. If you do not use the contributed Content Construction Kit (CCK) [5] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the Content Construction Kit (CCK) module for Drupal 6.x, upgrade to Content Construction Kit (CCK) 6.x-2.10 [6] Also see the Content Construction Kit (CCK) [7] project page. -------- REPORTED BY --------------------------------------------------------- * Michael Smith [8] * David Rothstein [9] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Pere Orga [10] of the Drupal Security Team * Neil Drumm [11], module maintainer and member of the Drupal Security Team -------- COORDINATED BY ------------------------------------------------------ * The Drupal Security Team [12] -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [13]. Learn more about the Drupal Security team and their policies [14], writing secure code for Drupal [15], and securing your site [16]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [17] [1] https://www.drupal.org/project/cck [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/SA-CORE-2015-002 [4] http://cve.mitre.org/ [5] https://www.drupal.org/project/cck [6] https://www.drupal.org/node/2507763 [7] https://www.drupal.org/project/cck [8] https://www.drupal.org/user/1291584 [9] https://www.drupal.org/u/david_rothstein [10] https://www.drupal.org/user/2301194 [11] https://www.drupal.org/user/3064 [12] https://www.drupal.org/security-team [13] https://www.drupal.org/contact [14] https://www.drupal.org/security-team [15] https://www.drupal.org/writing-secure-code [16] https://www.drupal.org/security/secure-configuration [17] https://twitter.com/drupalsecurity

1 0

jQuery Update - Less Critical - Open Redirect - SA-CONTRIB-2015-123
by security-news＠drupal.org 17 Jun '15

17 Jun '15

View online: https://www.drupal.org/node/2507729 * Advisory ID: DRUPAL-SA-CONTRIB-2015-123 * Project: jQuery Update [1] (third-party module) * Version: 7.x * Date: 2015-June-17 * Security risk: 9/25 ( Less Critical) AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:Default [2] * Vulnerability: Open Redirect -------- DESCRIPTION --------------------------------------------------------- The jQuery Update module enables you to update jQuery on your site. The module ships with a modified version of the core Overlay JavaScript file, which is vulnerable to an open redirect attack (see SA-CORE-2015-002 [3]). Only sites with the Overlay module enabled are vulnerable. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [4] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * jQuery Update 7.x-2.x versions prior to 7.x-2.6 Drupal core is not affected. If you do not use the contributed jQuery Update [5] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the jQuery Update module 2.x branch, upgrade to jQuery Update 7.x-2.6 [6] Also see the jQuery Update [7] project page. -------- REPORTED BY --------------------------------------------------------- * Jeroen Vreuls [8] * David Rothstein [9] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Pere Orga [10] of the Drupal Security Team * David Rothstein [11] of the Drupal Security Team * Rob Loach [12] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * The Drupal Security Team [13] -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [14]. Learn more about the Drupal Security team and their policies [15], writing secure code for Drupal [16], and securing your site [17]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [18] [1] https://www.drupal.org/project/jquery_update [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/SA-CORE-2015-002 [4] http://cve.mitre.org/ [5] https://www.drupal.org/project/jquery_update [6] https://www.drupal.org/node/2507555 [7] https://www.drupal.org/project/jquery_update [8] https://www.drupal.org/user/2700643 [9] https://www.drupal.org/user/124982 [10] https://www.drupal.org/user/2301194 [11] https://www.drupal.org/user/124982 [12] https://www.drupal.org/u/robloach [13] https://www.drupal.org/security-team [14] https://www.drupal.org/contact [15] https://www.drupal.org/security-team [16] https://www.drupal.org/writing-secure-code [17] https://www.drupal.org/security/secure-configuration [18] https://twitter.com/drupalsecurity

1 0

LABjs - Less Critical - Open Redirect - SA-CONTRIB-2015-124
by security-news＠drupal.org 17 Jun '15

17 Jun '15

View online: https://www.drupal.org/node/2507735 * Advisory ID: DRUPAL-SA-CONTRIB-2015-124 * Project: LABjs [1] (third-party module) * Version: 7.x * Date: 2015-June-17 * Security risk: 9/25 ( Less Critical) AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:Default [2] * Vulnerability: Open Redirect -------- DESCRIPTION --------------------------------------------------------- The LABjs module integrates LABjs with Drupal for web performance optimization. The module ships with a modified version of the core Overlay JavaScript file, which is vulnerable to an open redirect attack (see SA-CORE-2015-002 [3]). Only sites with the Overlay module enabled are vulnerable. -------- CVE IDENTIFIER(S) ISSUED -------------------------------------------- * /A CVE identifier [4] will be requested, and added upon issuance, in accordance with Drupal Security Team processes./ -------- VERSIONS AFFECTED --------------------------------------------------- * LABjs 7.x-1.x versions prior to 7.x-1.7. Drupal core is not affected. If you do not use the contributed LABjs [5] module, there is nothing you need to do. -------- SOLUTION ------------------------------------------------------------ Install the latest version: * If you use the LABjs module for Drupal 7.x, upgrade to LABjs 7.x-1.7 [6]. Also see the LABjs [7] project page. -------- REPORTED BY --------------------------------------------------------- * Jeroen Vreuls [8] * David Rothstein [9] of the Drupal Security Team -------- FIXED BY ------------------------------------------------------------ * Pere Orga [10] of the Drupal Security Team * David Rothstein [11] of the Drupal Security Team * Hai-Nam Nguyen [12] the module maintainer -------- COORDINATED BY ------------------------------------------------------ * The Drupal Security Team [13] -------- CONTACT AND MORE INFORMATION ---------------------------------------- The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact [14]. Learn more about the Drupal Security team and their policies [15], writing secure code for Drupal [16], and securing your site [17]. Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity [18] [1] https://www.drupal.org/project/labjs [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/SA-CORE-2015-002 [4] http://cve.mitre.org/ [5] https://www.drupal.org/project/labjs [6] https://www.drupal.org/node/2507561 [7] https://www.drupal.org/project/labjs [8] https://www.drupal.org/user/2700643 [9] https://www.drupal.org/u/david_rothstein [10] https://www.drupal.org/u/pere-orga [11] https://www.drupal.org/u/david_rothstein [12] https://www.drupal.org/u/jcisio [13] https://www.drupal.org/security-team [14] https://www.drupal.org/contact [15] https://www.drupal.org/security-team [16] https://www.drupal.org/writing-secure-code [17] https://www.drupal.org/security/secure-configuration [18] https://twitter.com/drupalsecurity

1 0

Jump to page:

2026

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

Security-news