Hírolvasó

Forms Steps - Critical - Access bypass - SA-CONTRIB-2019-064

Biztonsági figyelmeztetések (contrib) - 2019. augusztus 14. 19.33
Project: Forms StepsDate: 2019-August-14Security risk: Critical 16∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Access bypassDescription: 

Forms Steps provides an UI to create form workflows using form modes. It creates quick and configurable multisteps forms.

The module doesn't sufficiently check user permissions to access its workflows entities that allows to see any entities that have been created through the different steps of its multistep forms.

This vulnerability is mitigated by the fact that you have to know the Forms Steps URL to create a content linked to the flow. Also, all created content is very hard to edit through the same flow as you have to know the URL and the linked hash to the content.

Solution: 

Install the latest version:

Also see the Forms Steps project page.

Reported By: Fixed By: Coordinated By: 

External Links Filter - Moderately critical - Open Redirect Vulnerability - SA-CONTRIB-2019-063

Biztonsági figyelmeztetések (contrib) - 2019. augusztus 14. 19.26
Project: External Links FilterDate: 2019-August-14Security risk: Moderately critical 10∕25 AC:Basic/A:None/CI:None/II:None/E:Theoretical/TD:AllVulnerability: Open Redirect VulnerabilityDescription: 

The External Link Filter module provides an input filter that replaces external links by a local link that redirects to the target URL.

The module did not have protection for the Redirect URL to go where content authors intended.

Solution: 

Install the latest version:

Also see the External Links Filter project page.

Reported By: Fixed By: Coordinated By: 

Super Login - Moderately critical - Cross site scripting - SA-CONTRIB-2019-062

Biztonsági figyelmeztetések (contrib) - 2019. augusztus 14. 19.14
Project: Super LoginDate: 2019-August-14Security risk: Moderately critical 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross site scriptingDescription: 

This module improves the Drupal login page with the new features and layout.

The module doesn't sufficiently filter input text in the administration pages text configuration inputs. For example, the login text field.

The vulnerability is mitigated by the fact it can only be exploited by a user with the "Administer super login" permission.

Solution: 

Install the latest version:

Also see the Super Login project page.

Reported By: Fixed By: Coordinated By: 

scroll to top - Moderately critical - Cross site scripting - SA-CONTRIB-2019-061

Biztonsági figyelmeztetések (contrib) - 2019. augusztus 14. 19.01
Project: scroll to topDate: 2019-August-14Security risk: Moderately critical 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross site scriptingDescription: 

The Scroll To Top module enables you to have an animated scroll to top link in the bottom of the node.

The module does not sufficiently filter configuration text leading to a Cross Site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer scroll to top".

Solution: 

Install the latest version of the module.

Also see the scroll to top project page.

Reported By: Fixed By: Coordinated By: 

Existing Values Autocomplete Widget - Critical - Access bypass - SA-CONTRIB-2019-060

Biztonsági figyelmeztetések (contrib) - 2019. július 24. 19.36
Project: Existing Values Autocomplete WidgetDate: 2019-July-24Security risk: Critical 17∕25 AC:None/A:None/CI:All/II:None/E:Theoretical/TD:AllVulnerability: Access bypassDescription: 

This module provides an autocomplete widget for text fields that suggests all existing (previously entered) values for that field.

The module doesn't sufficiently check for proper access permission before returning autocomplete results.

This vulnerability is mitigated by the fact that an attacker must know the route to the autocomplete callback controller though this is easily known.

Solution: 

Install the latest version:

Also see the Existing Values Autocomplete Widget project page.

Reported By: Fixed By: Coordinated By: 

Facebook Messenger Customer Chat Plugin - Critical - Access bypass - SA-CONTRIB-2019-059

Biztonsági figyelmeztetések (contrib) - 2019. július 24. 18.49
Project: Facebook Messenger Customer Chat PluginDate: 2019-July-24Security risk: Critical 16∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Access bypassDescription: 

The Facebook Messenger Customer Chat Plugin module enables you to add the Facebook Messenger Customer Chat Plugin to your Drupal site.

The module doesn't require user permissions on the admin page.

Solution: 

Install the latest version:

Also see the Facebook Messenger Customer Chat Plugin project page.

Reported By: Reported by Fixed By: Coordinated By: 

Metatag - Moderately critical - Information disclosure - SA-CONTRIB-2019-058

Biztonsági figyelmeztetések (contrib) - 2019. július 24. 18.31
Project: MetatagDate: 2019-July-24Security risk: Moderately critical 13∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Information disclosureDescription: 

This module enables you to customize meta tags to help with a site's search engine ranking and improve the display of page summaries when shared on social networks.

The module doesn't sufficiently check for a site being in maintenance mode.

This vulnerability is mitigated by the fact that the site must be configured to disallow access to certain content, and must be put into maintenance mode.

Solution: 

Install the latest version:

Also see the Metatag project page.

Reported By: Fixed By: Coordinated By: 

Drupal core - Critical - Access bypass - SA-CORE-2019-008

Biztonsági figyelmeztetések (core) - 2019. július 17. 18.05
Project: Drupal coreDate: 2019-July-17Security risk: Critical 17∕25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Access bypassCVE IDs: CVE-2019-6342Description: 

In Drupal 8.7.4, when the experimental Workspaces module is enabled, an access bypass condition is created.

This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4.

Drupal 8.7.3 and earlier, Drupal 8.6.x and earlier, and Drupal 7.x are not affected.

Solution: 

If the site is running Drupal 8.7.4, upgrade to Drupal 8.7.5.

Note, manual step needed. For sites with the Workspaces module enabled, update.php needs to run to ensure a required cache clear. If there is a reverse proxy cache or content delivery network (e.g. Varnish, CloudFlare) it is also advisable to clear these as well.

Reported By: Fixed By: 

Meta tags quick - Moderately critical - Cross Site Scripting - SA-CONTRIB-2019-057

Biztonsági figyelmeztetések (contrib) - 2019. július 17. 18.00
Project: Meta tags quickDate: 2019-July-17Security risk: Moderately critical 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site ScriptingDescription: 

Metatags quick is a module that manages meta tags (tags that appear in HTML's head section) as Drupal 7 fields.
Administration page of metatags quick does not sanitize the output of blocks that appear on the same page. This allows an attacker to inject malicious JavaScript in block markup.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer blocks".

Solution: 

Install the latest version.

If you use the Metatags quick module for Drupal 7.x, upgrade to metatags quick 7.x-2.10.

Reported By: Fixed By: Coordinated By: 

ImageCache Actions - Critical - Multiple Vulnerabilities - SA-CONTRIB-2019-056

Biztonsági figyelmeztetések (contrib) - 2019. július 17. 17.57
Project: ImageCache ActionsDate: 2019-July-17Security risk: Critical 17∕25 AC:Basic/A:Admin/CI:All/II:All/E:Theoretical/TD:AllVulnerability: Multiple Vulnerabilities Description: 

The imagecache actions module defines a number of additional image effects that can be used to create image styles. The "Image styles admin" sub module provides additional functionality to duplicate, export and import image styles. The module uses unserialize() to import image styles into another site where unserialize() is known to have security issues when processing potentially unsafe input.

This vulnerability is mitigated by the fact that the "Image styles admin" sub module must be enabled and an attacker must have a role with the permission "'administer image styles'".

Furthermore, the import functionality supports PHP code included in image effects as part of an image style, which would run on image derivative generation subject to the PHP module being enabled. This is intended behaviour for the "Image styles admin" sub module, but the user access restrictions should reflect the potential risks involved.

The new security release of this module introduces a new "import image styles" permission which is marked as restricted. In order to use the image style import functionality, users will need to have a role which has this new permission in addition to "administer image styles" (which is not marked as restricted).

Solution: Reported By: Fixed By: Coordinated By: 

Custom Permissions - Critical - Access bypass - SA-CONTRIB-2019-055

Biztonsági figyelmeztetések (contrib) - 2019. július 10. 18.30
Project: Custom PermissionsVersion: 8.x-1.x-devDate: 2019-July-10Security risk: Critical 16∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Access bypassDescription: 

This module enables you to add and manage additional custom permissions through the administration UI.

The module doesn't sufficiently check for the proper access permissions to this page.

This vulnerability is mitigated by the fact that an attacker must know the route of the Custom Permissions administration form though this is easily known.

Solution: 

Install the latest version:

Also see the Custom Permissions project page.

Reported By: Fixed By: Coordinated By: 

Advanced Forum - Critical - Cross Site Scripting - SA-CONTRIB-2019-054

Biztonsági figyelmeztetések (contrib) - 2019. június 26. 15.42
Project: Advanced ForumVersion: 7.x-2.x-devDate: 2019-June-26Security risk: Critical 16∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site ScriptingDescription: 

Advanced Forum builds on and enhances Drupal's core forum module. When used in combination with other Drupal contributed modules, many of which are automatically used by Advanced Forum, you can achieve much of what stand alone software provides.

The module doesn't sufficiently sanitise user input in specific circumstances. It is not possible to disable the vulnerable functionality.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to create forum content.

Solution: 

Install the latest version:

Also see the Advanced Forum project page.

Reported By: Fixed By: Coordinated By: 

Easy Breadcrumb - Critical - Cross Site Scripting - SA-CONTRIB-2019-053

Biztonsági figyelmeztetések (contrib) - 2019. június 19. 19.08
Project: Easy BreadcrumbVersion: 7.x-2.x-devDate: 2019-June-19Security risk: Critical 18∕25 AC:Basic/A:None/CI:Some/II:Some/E:Exploit/TD:DefaultVulnerability: Cross Site ScriptingDescription: 

This module enables you to use the current URL (path alias) and the current page's title to automatically extract the breadcrumb's segments and its respective links then show them as breadcrumbs on your website.

The module doesn't sufficiently sanitise user input in certain circumstances.

This vulnerability does not require any permissions but can be mitigated by un-checking the 'Allow HTML tags in breadcrumb text' setting (enabled by default). In some cases browsers' built-in XSS protection may prevent exploitation.

Solution: 

Install the latest version:

Also see the Easy Breadcrumb project page.

Reported By: Fixed By: Coordinated By: 

Universally Unique IDentifier - Moderately critical - Access bypass - SA-CONTRIB-2019-052

Biztonsági figyelmeztetések (contrib) - 2019. május 29. 19.27
Project: Universally Unique IDentifierDate: 2019-May-29Security risk: Moderately critical 14∕25 AC:Complex/A:User/CI:All/II:Some/E:Theoretical/TD:DefaultVulnerability: Access bypassDescription: 

This module provides an API for adding universally unique identifiers (UUID) to Drupal objects, most notably entities.

The module has a privilege escalation vulnerability when it's used in combination with Services+REST server.

This vulnerability is mitigated by the fact that an attacker must authenticate to the site, services module must be configured on the site and the user update resource enabled.

Solution: 

Install the latest version:

  • If you use the Universally Unique IDentifier module for Drupal 7.x, upgrade to UUID 7.x-1.3

Also see the Universally Unique IDentifier project page.

Reported By: Fixed By: Coordinated By: 

TableField - Moderately critical - Access bypass and Cross Site Scripting - SA-CONTRIB-2019-051

Biztonsági figyelmeztetések (contrib) - 2019. május 29. 19.11
Project: TableFieldVersion: 7.x-3.x-dev7.x-2.x-devDate: 2019-May-29Security risk: Moderately critical 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Access bypass and Cross Site ScriptingDescription: 

This module allows you to attach tabular data to an entity.

Access bypass

There's no access check for users with an "Export Tablefield Data as CSV". They can export data from unpublished nodes or otherwise inaccessible entities.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission 'Export Tablefield Data as CSV'.

XSS

When "Raw data (JSON or XML)" is used in the field's Display settings, it doesn't sanitize JSON output before passing it on to be rendered.

This vulnerability is mitigated by the fact that an attacker must have a role with Edit permissions.

Solution: 

Install the latest version:

Also see the TableField project page.

Reported By: Fixed By: Coordinated By: 

Menu Item Extras - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2019-050

Biztonsági figyelmeztetések (contrib) - 2019. május 22. 18.29
Project: Menu Item ExtrasDate: 2019-May-22Security risk: Moderately critical 10∕25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross Site Request ForgeryDescription: 

This module enables you to handle fields for Custom Menu Links.
The module doesn't sufficiently check requests to one of the module controllers if the user has permission 'administer menu'.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create content.

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 

Workflow - Moderately critical - Cross Site Scripting - SA-CONTRIB-2019-049

Biztonsági figyelmeztetések (contrib) - 2019. május 22. 18.27
Project: WorkflowDate: 2019-May-22Security risk: Moderately critical 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site ScriptingDescription: 

The Workflow module enables you to create arbitrary Workflows, and assign them to Entities.
The module doesn't sufficiently escape HTML in the field settings leading to a Cross Site Scripting (XSS) vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer nodes" and "administer workflow".

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 

Multiple Registration - Critical - Access bypass - SA-CONTRIB-2019-048

Biztonsági figyelmeztetések (contrib) - 2019. május 15. 19.13
Project: Multiple RegistrationDate: 2019-May-15Security risk: Critical 19∕25 AC:Basic/A:None/CI:All/II:All/E:Theoretical/TD:DefaultVulnerability: Access bypassDescription: 

This module enables you to use special routes for user registration with special roles and custom field sets defined for the role.

The module doesn't sufficiently check which user roles can be registered under the scenario when the user tries to register the user with the administrator role.

This vulnerability is mitigated on sites where account approval is required as the user starts as blocked but still gets the "Administrator" role.

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 
  • Cash Williams of the Drupal Security Team
  • Opigno Learning path - Moderately critical - Access bypass - SA-CONTRIB-2019-047

    Biztonsági figyelmeztetések (contrib) - 2019. május 15. 19.09
    Project: Opigno Learning pathDate: 2019-May-15Security risk: Moderately critical 10∕25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:DefaultVulnerability: Access bypassDescription: 

    In certain configuration cases, when a learning path is configured as semi-private, anonymous users are allowed to join a learning path when they should not.

    Solution: 

    Install the latest version:

    Also see the Opigno Learning path project page.

    Reported By: Fixed By: Coordinated By: 

    Opigno forum - Less critical - Access bypass - SA-CONTRIB-2019-046

    Biztonsági figyelmeztetések (contrib) - 2019. május 15. 19.07
    Project: Opigno forumDate: 2019-May-15Security risk: Less critical 9∕25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Access bypassDescription: 

    In certain circumstances it is possible that certain forum information is available to unprivileged users because the access check is done with node access instead of grants.

    This vulnerability is mitigated by the fact that the module itself does not disclose information but only if there are listings such as views where the site builder / developer has not taken this into account.

    Solution: 

    Install the latest version:

    Also see the Opigno forum project page.

    Reported By: Fixed By: Coordinated By: