View online: https://www.drupal.org/sa-contrib-2022-064
Project: H5P - Create and Share Rich Content and Applications [1] Date: 2022-December-14 Security risk: *Moderately critical* 12∕25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:Default [2] Vulnerability: Remote Code Execution
Description: This module enables you to create interactive content.
The module doesn't sufficiently stop path traversal attacks through zipped filenames for the uploadable .h5p files.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "update h5p libraries". In addition, it is only exploitable on Windows servers.
Solution: Install the latest version:
* If you use the H5P module for Drupal 7.x, upgrade to H5P 7.x-1.51 [3]
Reported By: Disclosed publicly.
Fixed By: * Frode Petterson [4] * paalj [5]
Coordinated By: * Greg Knaddison [6] of the Drupal Security Team
[1] https://www.drupal.org/project/h5p [2] https://www.drupal.org/security-team/risk-levels [3] https://www.drupal.org/project/h5p/releases/7.x-1.51 [4] https://www.drupal.org/user/823190 [5] https://www.drupal.org/user/1091732 [6] https://www.drupal.org/user/36762