Hírolvasó

The Better Mega Menu - Moderately critical - Access bypass - SA-CONTRIB-2021-041

Biztonsági figyelmeztetések (contrib) - 2021. szeptember 22. 19.26
Project: The Better Mega MenuDate: 2021-September-22Security risk: Moderately critical 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Proof/TD:DefaultVulnerability: Access bypassDescription: 

This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content.

This module has a vulnerability whereby users can select blocks as a menu item they don't have permission to view.

The vulnerability is mitigated by the fact that it can only be exploited by an attacker with the "Administer TB Mega Menu" permission.

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 

The Better Mega Menu - Critical - Cross Site Request Forgery - SA-CONTRIB-2021-040

Biztonsági figyelmeztetések (contrib) - 2021. szeptember 22. 19.26
Project: The Better Mega MenuDate: 2021-September-22Security risk: Critical 15∕25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Request ForgeryDescription: 

This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content.

The module does not use CSRF tokens to protect routes for saving menu configurations.

This vulnerability can be exploited by an anonymous user.

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 

The Better Mega Menu - Moderately critical - Cross Site Scripting - SA-CONTRIB-2021-039

Biztonsági figyelmeztetések (contrib) - 2021. szeptember 22. 19.26
Project: The Better Mega MenuDate: 2021-September-22Security risk: Moderately critical 13∕25 AC:Complex/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site ScriptingDescription: 

This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content.

It does not sufficiently sanitize user input such that an admin with permissions to edit a menu may be able to exploit one or more Cross-Site-Scripting (XSS) vulnerabilities.

This vulnerability is mitigated by the fact that an attacker must have permission to administer mega menus and/or create or edit menu links, to inject the XSS.

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 

The Better Mega Menu - Moderately critical - Cross Site Scripting, Information Disclosure, Multiple vulnerabilities - SA-CONTRIB-2021-038

Biztonsági figyelmeztetések (contrib) - 2021. szeptember 22. 19.25
Project: The Better Mega MenuDate: 2021-September-22Security risk: Moderately critical 12∕25 AC:Complex/A:Admin/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Scripting, Information Disclosure, Multiple vulnerabilitiesDescription: 

This module provides an admin interface for creating drop down menus that combine Drupal menu items with rich media content.

The module does not sanitize values for CSS properties that are added by admins and rendered on the front-end, allowing attackers to inject malicious code into the front-end markup.

This vulnerability is mitigated by the fact that it can only be exploited by an attacker with permissions to administer TB Mega Menu, or a sophisticated anonymous user using a site-specific attack that exploits the Cross Site Request Forgery vulnerability that is fixed by this same release.

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 

Domain Group - Critical - Access bypass - SA-CONTRIB-2021-037

Biztonsági figyelmeztetések (contrib) - 2021. szeptember 22. 19.17
Project: Domain GroupDate: 2021-September-22Security risk: Critical 18∕25 AC:None/A:None/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Access bypassDescription: 

This module enables sites to define a domain from Domain Access that points directly to a group page.

The module doesn't sufficiently manage the access to content administrative paths allowing an attacker to see and take actions on content (nodes) they should be allowed to.

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 

SAML SP 2.0 Single Sign On (SSO) - SAML Service Provider - Moderately critical - Multiple vulnerabilities - SA-CONTRIB-2021-036

Biztonsági figyelmeztetések (contrib) - 2021. szeptember 22. 19.12
Project: SAML SP 2.0 Single Sign On (SSO) - SAML Service ProviderDate: 2021-September-22Security risk: Moderately critical 14∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Multiple vulnerabilitiesDescription: 

This module provides a solution to authenticate visitors using existing SAML providers.

Certain non-default configurations allow a malicious user to login as any chosen user.

The vulnerability is mitigated by the module's default settings which require the options "Either sign SAML assertions" and "x509 certificate".

Solution: 

Ensure that the "Either SAML response or SAML assertion must be signed" and "x509 certificate" options on the dedicated plugin page are both enabled.

Install the latest version:

Reported By: Fixed By: Coordinated By: 

Taxonomy Manager - Moderately critical - Access bypass - SA-CONTRIB-2021-035

Biztonsági figyelmeztetések (contrib) - 2021. szeptember 22. 19.09
Project: Taxonomy ManagerDate: 2021-September-22Security risk: Moderately critical 10∕25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:DefaultVulnerability: Access bypassDescription: 

This module provides a powerful interface for managing a taxonomy vocabulary. A vocabulary gets displayed in a dynamic tree view, where parent terms can be expanded to list their nested child terms or can be collapsed.

The module does not take the correct user permissions into account, allowing an attacker to delete and move terms.

The issue is mitigated by the fact that an attacker must have permission to create terms in the targeted vocabulary.

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 

Search API attachments - Critical - Arbitrary PHP code execution - SA-CONTRIB-2021-034

Biztonsági figyelmeztetések (contrib) - 2021. szeptember 22. 18.58
Project: Search API attachmentsDate: 2021-September-22Security risk: Critical 15∕25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:DefaultVulnerability: Arbitrary PHP code executionDescription: 

This module enables you to extract the textual content of files for use on a website, e.g. to display it or or use it in search indexes.

The module doesn't sufficiently protect the administrator-defined commands which are executed on the server, which leads to post-authentication remote code execution by a limited set of users.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer search_api". Sites are encouraged to review which roles have that permission and which users have that role, to ensure that only trusted users have that permission.

Solution: 

Install the latest version:

The 8.x branch does not have Security Coverage.

Reported By: Fixed By: Coordinated By: 

File Extractor - Critical - Arbitrary PHP code execution - SA-CONTRIB-2021-033

Biztonsági figyelmeztetések (contrib) - 2021. szeptember 22. 18.55
Project: File ExtractorDate: 2021-September-22Security risk: Critical 15∕25 AC:Complex/A:Admin/CI:All/II:All/E:Theoretical/TD:DefaultVulnerability: Arbitrary PHP code executionDescription: 

This module enables you to extract the textual content of files for use on a website, e.g. to display it or or use it in search indexes.

The module doesn't sufficiently protect the administrator-defined commands which are executed on the server, which leads to post-authentication remote code execution by a limited set of users.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer File Extractor" to access the settings form. Sites are encouraged to review which roles have that permission and which users have that role, to ensure that only trusted users have that permission.

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 

Commerce Core - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2021-032

Biztonsági figyelmeztetések (contrib) - 2021. szeptember 22. 18.51
Project: Commerce CoreDate: 2021-September-22Security risk: Moderately critical 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Access bypass, Information DisclosureDescription: 

This module provides a system for building an ecommerce solution in their Drupal site.

The module doesn't sufficiently verify access to profile data in certain circumstances.

This vulnerability is mitigated by the fact that an attacker must have permission to perform the checkout operation.

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 

Client-side Hierarchical Select - Moderately critical - Cross-site scripting - SA-CONTRIB-2021-031

Biztonsági figyelmeztetések (contrib) - 2021. szeptember 22. 18.49
Project: Client-side Hierarchical SelectDate: 2021-September-22Security risk: Moderately critical 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross-site scriptingDescription: 

The module provides a field widget for selecting taxonomy terms in a hierarchical fashion.

The module doesn't sanitize user input in certain cases, leading to a possible Cross-Site-Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to create or edit taxonomy terms to which the widget may apply.

Solution: 

Install the latest version:

Reported By: Fixed By: Coordinated By: 

User hash - Moderately critical - Cache poisoning - SA-CONTRIB-2021-030

Biztonsági figyelmeztetések (contrib) - 2021. szeptember 22. 18.43
Project: User hashDate: 2021-September-22Security risk: Moderately critical 12∕25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:AllVulnerability: Cache poisoningDescription: 

This module enables you to create an individual hash for each user. These hashes can be used for authentication instead of the user's password, e.g. for views exporters.

The module doesn't sufficiently invalidate page output when the page_cache module is used.

This vulnerability is mitigated by the fact that an attacker must have a user hash that grants access to specific content and the attack must be timed to the reset of the page cache.

Solution: 

Install the latest version:

  • If you use the user_hash module for Drupal 8 or 9, upgrade to User Hash 2.0.1
Reported By: Fixed By: Coordinated By: 

GraphQL - Moderately critical - Access bypass - SA-CONTRIB-2021-029

Biztonsági figyelmeztetések (contrib) - 2021. szeptember 15. 17.30
Project: GraphQLDate: 2021-September-15Security risk: Moderately critical 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Access bypassCVE IDs: CVE-2020-13675Description: 

This advisory addresses a similar issue to Drupal core - Moderately critical - Access bypass - SA-CORE-2021-008.

The GraphQL module allows file uploads through its HTTP API. The module does not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site.

This vulnerability is mitigated by four factors:

  1. The GraphQL module must be enabled on the site.
  2. The GraphQL schema must expose a file upload by using the helper "src/GraphQL/Utility/FileUpload.php" in the module.
  3. An attacker must have access to that file upload via the GraphQL API.
  4. The site must employ a file validation module.
Solution: 

Install the latest version:

  • If you use the GraphQL module 8.x-4.x for Drupal 8.x or 9.x, upgrade to GraphQL 8.x-4.2
  • If you use the GraphQL module 8.x-3.x for Drupal 8.x no action is needed as a result of this advisory as the 8.x-3.x branch is not affected by this issue.
Reported By: Fixed By: Coordinated By: 
  • xjm of the Drupal Security Team
  • Drew Webber of the Drupal Security Team

Entity Embed - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2021-028

Biztonsági figyelmeztetések (contrib) - 2021. szeptember 15. 17.28
Project: Entity EmbedDate: 2021-September-15Security risk: Moderately critical 11∕25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site Request ForgeryCVE IDs: CVE-2020-13673Description: 

This advisory addresses a similar issue to Drupal core - Moderately critical - Cross Site Request Forgery - SA-CORE-2021-006.

The Entity Embed module provides a filter to allow embedding entities in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed entities. In some cases, this could lead to cross-site scripting.

Solution: 

Install the latest version:

Drupal 7 versions of Entity Embed do not have a stable release and therefore do not receive security coverage.

Reported By: Fixed By: Coordinated By: 
  • xjm of the Drupal Security Team
  • Drew Webber of the Drupal Security Team

Drupal core - Moderately critical - Access Bypass - SA-CORE-2021-010

Biztonsági figyelmeztetések (core) - 2021. szeptember 15. 17.25
Project: Drupal coreDate: 2021-September-15Security risk: Moderately critical 12∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:DefaultVulnerability: Access BypassCVE IDs: CVE-2020-13677Description: 

Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass.

Sites that do not have the JSON:API module enabled are not affected.

This advisory is not covered by Drupal Steward.

Solution: 

Install the latest version:

Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage.

Drupal 7 core does not include the JSON:API module and therefore is not affected.

Reported By: Fixed By: 

Drupal core - Moderately critical - Access bypass - SA-CORE-2021-009

Biztonsági figyelmeztetések (core) - 2021. szeptember 15. 17.23
Project: Drupal coreDate: 2021-September-15Security risk: Moderately critical 10∕25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:DefaultVulnerability: Access bypassCVE IDs: CVE-2020-13676Description: 

The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data.

Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.

This advisory is not covered by Drupal Steward.

Solution: 

Install the latest version:

Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage.

Drupal 7 core does not include the QuickEdit module and therefore is not affected.

Uninstalling the QuickEdit module will also mitigate the vulnerability. Site owners may wish to consider this option as the QuickEdit module will be removed from core in Drupal 10.

Reported By: Fixed By: 

Drupal core - Moderately critical - Access bypass - SA-CORE-2021-008

Biztonsági figyelmeztetések (core) - 2021. szeptember 15. 17.22
Project: Drupal coreDate: 2021-September-15Security risk: Moderately critical 11∕25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:UncommonVulnerability: Access bypassCVE IDs: CVE-2020-13675Description: 

Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site.

This vulnerability is mitigated by three factors:

  1. The JSON:API or REST File upload modules must be enabled on the site.
  2. An attacker must have access to a file upload via JSON:API or REST.
  3. The site must employ a file validation module.

This advisory is not covered by Drupal Steward.

Also see GraphQL - Moderately critical - Access bypass - SA-CONTRIB-2021-029 which addresses a similar vulnerability for that module.

Solution: 

Install the latest version:

Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage.

Drupal 7 core is not affected.

Reported By: Fixed By: 

Drupal core - Moderately critical - Cross Site Request Forgery - SA-CORE-2021-007

Biztonsági figyelmeztetések (core) - 2021. szeptember 15. 17.20
Project: Drupal coreDate: 2021-September-15Security risk: Moderately critical 14∕25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross Site Request ForgeryCVE IDs: CVE-2020-13674Description: 

The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues.

Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. Removing the "access in-place editing" permission from untrusted users will not fully mitigate the vulnerability.

This advisory is not covered by Drupal Steward.

Solution: 

Install the latest version:

Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage.

Drupal 7 core does not include the QuickEdit module and therefore is not affected.

Uninstalling the QuickEdit module will also mitigate the vulnerability. Site owners may wish to consider this option as the QuickEdit module will be removed from core in Drupal 10.

Reported By: Fixed By: 

Drupal core - Moderately critical - Cross Site Request Forgery - SA-CORE-2021-006

Biztonsági figyelmeztetések (core) - 2021. szeptember 15. 17.18
Project: Drupal coreDate: 2021-September-15Security risk: Moderately critical 10∕25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross Site Request ForgeryCVE IDs: CVE-2020-13673Description: 

The Drupal core Media module allows embedding internal and external media in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed media. In some cases, this could lead to cross-site scripting.

This advisory is not covered by Drupal Steward.

Also see Entity Embed - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2021-028 which addresses a similar vulnerability for that module.

Updated 18:15 UTC to clarify text.

Solution: 

Install the latest version:

Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage.

Drupal 7 core is not affected.

Reported By: Fixed By: 

Webform - Moderately critical - Cross Site Scripting - SA-CONTRIB-2021-026

Biztonsági figyelmeztetések (contrib) - 2021. augusztus 25. 17.27
Project: WebformDate: 2021-August-25Security risk: Moderately critical 12∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:UncommonVulnerability: Cross Site ScriptingDescription: 

The Webform module uses the CKEditor, library for WYSIWYG editing. CKEditor has released a security update that impacts Webform.

An attacker that can create or edit content (even without access to CKEditor themselves) may be able to exploit one or more Cross-Site Scripting (XSS) vulnerabilities to target users with access to the WYSIWYG CKEditor, including site admins with privileged access.

For more information, see CKEditor's announcement of the release.

Solution: 

Install the latest version:

If you are using a previous release of the Webform module you can immediately do one of several options.

  1. Update Drupal
  2. If you are using Composer, run drush webform:libraries:composer > DRUPAL_ROOT/composer.libraries.json and run composer update
  3. If you are using Drush, run drush webform:libraries:update

Learn more about updating Webform libraries.

Reported By: Fixed By: Coordinated By: