Drupal Security
SpamSpan filter - Moderately critical - Cross site scripting - SA-CONTRIB-2020-002
The SpamSpan module obfuscates email addresses to help prevent spambots from collecting them.
This module contains a spamspan twig filter which doesn't sanitize the passed HTML string.
This vulnerability is mitigated by the fact that sites must have custom twig template files that use the SpamSpan filter on a field that an attacker could populate. By default the SpamSpan module does not use the vulnerable twig filter.
Solution:Install the latest version:
- If you use the SpamSpan module for Drupal 8.x, upgrade to SpamSpan 8.x-1.1
Also see the SpamSpan filter project page.
Reported By: Fixed By: Coordinated By:- Ben Jeavons of the Drupal Security Team
Radix - Moderately critical - Cross site scripting - SA-CONTRIB-2020-001
Radix is a base theme for Drupal, with Bootstrap 4, Sass, ES6 and BrowserSync built-in.
The module doesn't sufficiently filter menu titles when used in a dropdown in the main menu.
This vulnerability is mitigated by the fact that an attacker must have permission to edit a menu title used in the main menu.
Solution:Install the latest version:
- If you use the Radix theme for Drupal 7.x, upgrade to Radix 7.x-3.8
Also see the Radix project page.
Reported By: Fixed By:- David Snopek of the Drupal Security Team
- David Snopek of the Drupal Security Team
Drupal core - Critical - Multiple vulnerabilities - SA-CORE-2019-012
The Drupal project uses the third-party library Archive_Tar, which has released a security improvement that is needed to protect some Drupal configurations.
Multiple vulnerabilities are possible if Drupal is configured to allow .tar, .tar.gz, .bz2 or .tlz file uploads and processes them.
The latest versions of Drupal update Archive_Tar to 1.4.9 to mitigate the file processing vulnerabilities.
Edited to clarify the nature of the upstream release.
Solution:Install the latest version:
- If you are using Drupal 7.x, upgrade to Drupal 7.69.
- If you are using Drupal 8.7.x, upgrade to Drupal 8.7.11.
- If you are using Drupal 8.8.x, upgrade to Drupal 8.8.1.
Versions of Drupal 8 prior to 8.7.x are end-of-life and do not receive security coverage.
Additional informationAll advisories released today:
Updating to the latest Drupal core release will apply the fixes for all the above advisories.
(Note that this SA is the only one in the list that applies to Drupal 7.x)
Reported By: Fixed By:- Lee Rowlands of the Drupal Security Team
- Peter Wolanin of the Drupal Security Team
- Sam Becker
- Jasper Mattsson
- David Rothstein of the Drupal Security Team
- michieltcs
- Ayesh Karunaratne
- Alex Pott of the Drupal Security Team
- Jess of the Drupal Security Team
- Samuel Mortenson of the Drupal Security Team
- Vijaya Chandran Mani Provisional Security Team Member
- Drew Webber of the Drupal Security Team
Drupal core - Moderately critical - Access bypass - SA-CORE-2019-011
The Media Library module has a security vulnerability whereby it doesn't sufficiently restrict access to media items in certain configurations.
Solution:- If you are using Drupal 8.7.x, you should upgrade to Drupal 8.7.11.
- If you are using Drupal 8.8.x, you should upgrade to Drupal 8.8.1.
Versions of Drupal 8 prior to 8.7.x are end-of-life and do not receive security coverage.
Alternatively, you may mitigate this vulnerability by unchecking the "Enable advanced UI" checkbox on /admin/config/media/media-library. (This mitigation is not available in 8.7.x.)
Additional informationAll advisories released today:
Updating to the latest Drupal core release will apply the fixes for all the above advisories.
Reported By: Fixed By:- Adam G-H
- Jess of the Drupal Security Team
- Andrei Mateescu
- Greg Knaddison of the Drupal Security Team
- Alex Bronstein of the Drupal Security Team
- Sean Blommaert
- Lee Rowlands of the Drupal Security Team
Drupal core - Moderately critical - Multiple vulnerabilities - SA-CORE-2019-010
Drupal 8 core's file_save_upload() function does not strip the leading and trailing dot ('.') from filenames, like Drupal 7 did.
Users with the ability to upload files with any extension in conjunction with contributed modules may be able to use this to upload system files such as .htaccess in order to bypass protections afforded by Drupal's default .htaccess file.
After this fix, file_save_upload() now trims leading and trailing dots from filenames.
Solution:Install the latest version:
Versions of Drupal 8 prior to 8.7.x are end-of-life and do not receive security coverage.
Additional informationAll advisories released today:
Updating to the latest Drupal core release will apply the fixes for all the above advisories.
Reported By: Fixed By:- Lee Rowlands of the Drupal Security Team
- Greg Knaddison of the Drupal Security Team
- Michael Hess of the Drupal Security Team
- Kim Pepper
- Alex Pott of the Drupal Security Team
- Derek Wright
- Jess of the Drupal Security Team
- David Rothstein of the Drupal Security Team
Drupal core - Moderately critical - Denial of Service - SA-CORE-2019-009
A visit to install.php can cause cached data to become corrupted. This could cause a site to be impaired until caches are rebuilt.
Solution:Install the latest version:
- If you are using Drupal 8.7.x, upgrade to Drupal 8.7.11.
- If you are using Drupal 8.8.x, upgrade to Drupal 8.8.1.
Versions of Drupal 8 prior to 8.7.x are end-of-life and do not receive security coverage.
To mitigate this issue in any version of Drupal 8, you can also block access to install.php if it's not required.
Additional informationAll advisories released today:
Updating to the latest Drupal core release will apply the fixes for all the above advisories.
Reported By:- Drew Webber of the Drupal Security Team
- Drew Webber of the Drupal Security Team
- Lee Rowlands of the Drupal Security Team
- Heine of the Drupal Security Team
- Alex Pott of the Drupal Security Team
- Jess of the Drupal Security Team
- Damien McKenna of the Drupal Security Team
- David Snopek of the Drupal Security Team
- Nathaniel Catchpole of the Drupal Security Team
- Greg Knaddison of the Drupal Security Team
Webform - Critical - Multiple vulnerabilities - SA-CONTRIB-2019-096
This module enables you to create forms to collect information from users and report, analyze and distribute it by email.
The 7.x-3.x module doesn't sufficiently sanitize token values taken from query strings. If a query string token is used as the value of a markup component, an attacker can inject JavaScript into a page.
The 7.x-4.x module doesn't sufficiently protect against an attacker changing the submission identifier of a draft webform, thereby overwriting another user's submission. Confidential information is not disclosed, but information can be overwritten and therefore lost or forged.
The 7.x-4.x vulnerability is mitigated by the fact that an attacker must have a role with permission to submit a webform and the webform must have the advanced form setting of either 'Show "Save draft" button' and/or "Automatically save as draft between pages and when there are validation errors". Neither of these two options are enabled by default. Anonymous users cannot submit drafts and therefore cannot exploit this vulnerability.
Solution:Install the latest version:
- If you use the Webform 3.x module for Drupal 7.x, upgrade to Webform 7.x-3.29 or to Webform 7.x-4.21.
- If you use the Webform 4.x module for Drupal 7.x, upgrade to Webform 7.x-4.21
- Greg Knaddison of the Drupal Security Team
- Michael Hess of the Drupal Security Team
Permissions by Term - Moderately critical - Access bypass - SA-CONTRIB-2019-095
The Permissions by Term module extends Drupal by functionality for restricting access to single nodes via taxonomy terms.
The module doesn't sufficiently restrict access to node previews, when the Search API module is used to display nodes in search result lists.
Solution:Install the latest version:
- If you use the Permissions by Term module for Drupal 8.x, including all of the 8.x-1.x branch, upgrade to Version 8.x-2.0 or later.
- The settings have been refactored. They are now bundled in the "permissions_by_term.settings.yml" file. There are not so many settings, so you can simply visit PbT's settings page and set the settings manually. Like the setting for "single term restriction".
Also see the Permissions by Term project page.
Reported By: Fixed By: Coordinated By:- Greg Knaddison of the Drupal Security Team
Modal Page - Moderately critical - Access bypass - SA-CONTRIB-2019-094
This project enables administrators to create modal dialogs.
The routes used by the module lacked proper permissions, allowing untrusted users to access, create and modify modal configurations.
Solution:- If you use the Modal Page module 8.x-2.x, upgrade to 8.x-2.5
- Review user permissions after updating to ensure only trusted users have access to manage modals.
- Damien McKenna of the Drupal Security Team
Taxonomy access fix - Moderately critical - Access bypass - SA-CONTRIB-2019-093
This module extends access handling of Drupal Core's Taxonomy module.
The module doesn't sufficiently check,
- if a given entity should be access controlled, defaulting to allowing access even to unpublished Taxonomy Terms.
- if certain administrative routes should be access controlled, defaulting to allowing access even to users without permission to access these administrative routes.
The vulnerability is mitigated by the facts, that
- the user interface to change the status of Taxonomy Terms has been released in Drupal Core 8.8 and a custom or contributed module is required in earlier versions of Drupal Core to mark Taxonomy Terms as unpublished.
- all entity operations (except the view operation) available on affected administrative routes still require appropriate permissions.
- an attacker must have a role with permission to either access content or view a Taxonomy Term in a vocabulary.
Install the latest version:
- If you use taxonomy_access_fix 8.x-2.4 or later, upgrade to Taxonomy Access Fix 8.x-2.7
Also see the Taxonomy Access Fix project page.
Reported By: Fixed By: Coordinated By:- Greg Knaddison of the Drupal Security Team
- Damien McKenna of the Drupal Security Team
Smart Trim - Moderately critical - Cross site scripting - SA-CONTRIB-2019-092
The Smart Trim module allows site builders additional control with text summary fields.
The module doesn't sufficiently filter text when certain options are selected.
This vulnerability is mitigated by the fact that an attacker must have a role with the ability to create content on the site when certain options are selected for the trimmed output.
Solution:Install the latest version:
- If you use the Smart Trim module for Drupal 8.x, upgrade to smart_trim-8.x-1.2
Also see the Smart Trim project page.
Reported By: Fixed By: Coordinated By:- Damien McKenna of the Drupal Security Team
Floating Button Menu - Critical - Unsupported - SA-CONTRIB-2019-091
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported
Solution:If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported in full.
Webform Multiple File Upload - Critical - Unsupported - SA-CONTRIB-2019-090
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported
Solution:If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported in full.
Commerce Ingenico - Critical - Unsupported - SA-CONTRIB-2019-089
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported
Solution:If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported in full.
SendinBlue - Critical - Unsupported - SA-CONTRIB-2019-088
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported
Solution:If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported in full.
Make Meeting Scheduler - Critical - Unsupported - SA-CONTRIB-2019-087
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported
Solution:If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported in full.
Webform Report - Critical - Unsupported - SA-CONTRIB-2019-086
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported
Solution:If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported in full.
Nodequeue - Critical - Cross Site Scripting - SA-CONTRIB-2019-085
Updated November 22.
This module enables you to collect nodes in an arbitrarily ordered list.
Nodequeue's JavaScript can be leveraged to insert HTML from attacker-controlled JSON data. This is exploitable if user-submitted "Filtered HTML" content is displayed on a page where nodequeue.js is loaded.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "manipulate queues".
Original advisory:
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported
Install the latest version:
- If you use the Nodequeue module for Drupal 7.x, upgrade to Nodequeue 7.x-2.2
Also see the Nodequeue project page.
Original solution
If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported in full.
Reported By: Fixed By: Coordinated By:- Greg Knaddison of the Drupal Security Team
- Michael Hess of the Drupal Security Team
Taxonomy CSV import/export - Moderately critical - Information disclosure - SA-CONTRIB-2019-084
Updated January 9th, 2020
This module enables you to import taxonomy terms from different sources, including a text area, a file upload or a file present in the web server.
The module doesn't sufficiently validate user input when providing a local
filename to import.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission "import taxonomy by csv".
Original advisory:
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported
Solution:Install the latest version:
- If you use the Taxonomy CSV module for Drupal 7.x, upgrade to taxonomy_csv 7.x-5.11
- Ariel Barreiro, the module maintainer
- David Snopek of the Drupal Security Team
Feeds JSONPath Parser - Critical - Unsupported - SA-CONTRIB-2019-083
The security team is marking this project unsupported. There is a known security issue with the project that has not been fixed by the maintainer. If you would like to maintain this project, please read: https://www.drupal.org/node/251466#procedure---own-project---unsupported
Solution:If you use this project, you should uninstall it. To take over maintainership, please read https://www.drupal.org/node/251466#procedure---own-project---unsupported in full.
Neue Kommentare
vor 22 Minuten 55 Sekunden
vor 34 Minuten 50 Sekunden
vor 1 Stunde 54 Minuten
vor 2 Stunden 27 Minuten
vor 2 Stunden 50 Minuten
vor 9 Stunden 14 Minuten
vor 14 Stunden 44 Minuten
vor 15 Stunden 6 Minuten
vor 18 Stunden 43 Sekunden
vor 18 Stunden 11 Minuten