Biztonsági figyelmeztetések (contrib)
Material Admin - Critical - Unsupported - SA-CONTRIB-2025-006
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
Solution:If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
Flattern – Multipurpose Bootstrap Business Profile - Critical - Unsupported - SA-CONTRIB-2025-005
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
Solution:If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#s-becoming-owner-maintainer-or-co-mai...
AI (Artificial Intelligence) - Moderately critical - Access bypass, Information Disclosure - SA-CONTRIB-2025-004
The AI logging sub-module enables you to log AI requests and responses for debugging and auditing purposes.
The module doesn't sufficiently check for access to view the preview listing of the logs. Full log details are correctly protected, and API keys are never logged.
This vulnerability is mitigated by the fact that it only affects sites using the AI Logging sub-module with 'Log requests' enabled in the AI Logging configuration page.
Solution:Install the latest version:
- If you use AI 1.x, upgrade to AI 1.0.3.
An update hook will update the view to use the view ai log permission. If you use version controlled configuration, remember to capture this.
(or) Disable the AI Logging module.
(or) Manually update the ai_logs view's access check to use the view ai log permission.
Reported By: Fixed By: Coordinated By:- Greg Knaddison of the Drupal Security Team
- Juraj Nemec of the Drupal Security Team
- Dave Long of the Drupal Security Team
AI (Artificial Intelligence) - Critical - Cross Site Request Forgery - SA-CONTRIB-2025-003
The Drupal AI module provides a framework for easily integrating Artificial Intelligence on any Drupal site using any kind of AI (from multiple vendors). The sub-modules AI Chatbot and AI Assistants API allow users to interact with the Drupal site via a 'chat' interface.
The AI Chatbot module doesn't protect against Cross Site Request Forgeries in the Deepchat chatbot. This could allow an attacker to craft a scenario that can forge a request on behalf of a privileged user. When combined with the AI Search submodule, this could result in the AI Assistant exposing indexed data that the attacker should not have access to. When combined with the external AI Agent module, this could result in the AI Assistant exposing and allowing modification of site configuration of fields, content types, and vocabularies. Sites with custom built agents, with more privileged access, could be at greater risk from an exploit of this vulnerability.
This vulnerability is mitigated by:
- The targeted user needs to have an active session with a role with the "access deepchat api" permission and permission to assistants.
- To extract data, the target site must have a permissive CORS policy allowing the attacking site to read the result of a cross origin request.
- To modify data, the targeted user must have permission to use the configured agents.
Install the latest version:
- If you use the AI module, upgrade to AI 1.0.2
If you cannot update, you can can uninstall the AI Chatbot sub-module.
Reported By: Fixed By: Coordinated By:- Greg Knaddison of the Drupal Security Team
- Drew Webber of the Drupal Security Team
- Juraj Nemec of the Drupal Security Team
