Show advisories for only Drupal Core, only contributed projects, or only PSAs

Swift Mailer - Moderately critical - Access bypass - SA-CONTRIB-2024-006

Date: 
2024-January-24
Security risk: 
Moderately critical 12∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default

The Drupal Swift Mailer module extends the basic e-mail sending functionality provided by Drupal by delegating all e-mail handling to the Swift Mailer library. This enables your site to take advantage of the many features which the Swift Mailer library provides.

The module could allow an attacker to gain widespread access to a Drupal site. This vulnerability is mitigated by the fact that an attacker must have a means to trigger sending an email with a body that they can control, which would requires either another contributed module or custom integration.

Open Social - Moderately critical - Information Disclosure - SA-CONTRIB-2024-005

Date: 
2024-January-24
Security risk: 
Moderately critical 13∕25 AC:None/A:User/CI:Some/II:None/E:Proof/TD:Default

Open Social is a Drupal distribution for online communities.

The included optional social_group_flexible_group module doesn't sufficiently validate group updates. The lack of validation makes it possible to have content inside the group changing it's visibility, which could lead to that content being shown to a broader audience than intended.

This vulnerability is mitigated by the fact the module social_group_flexible_group needs to be enabled.

Open Social - Moderately critical - Access bypass - SA-CONTRIB-2024-004

Date: 
2024-January-24
Security risk: 
Moderately critical 10∕25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:Default

Content within Open Social can have different visibilities. It is possible for a user to create public content even when this should not be allowed.
This vulnerability is mitigated by the fact that the site must have public visibility disabled on a global level.

Two-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2024-003

Date: 
2024-January-24
Security risk: 
Moderately critical 14∕25 AC:Complex/A:None/CI:Some/II:Some/E:Proof/TD:Uncommon

This module enables you to allow and/or require users to use a second authentication method in addition to password authentication.

In some cases, the module allows users to log in with an authentication plugin that an administrator has disabled.

This vulnerability is mitigated by the fact that an attacker must obtain a valid first-factor login credential, that an administrator must enable and then disable an authentication plugin, and that an attacker must obtain the valid second factor credential for the disabled plugin.

Drupal core - Moderately critical - Denial of Service - SA-CORE-2024-001

Date: 
2024-January-17
Security risk: 
Moderately critical 11∕25 AC:None/A:None/CI:None/II:None/E:Theoretical/TD:Default

The Comment module allows users to reply to comments. In certain cases, an attacker could make comment reply requests that would trigger a denial of service (DOS).

Sites that do not use the Comment module are not affected.

Typogrify - Moderately critical - Cross Site Scripting - SA-CONTRIB-2024-002

Date: 
2024-January-10
Security risk: 
Moderately critical 12∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Uncommon

The Typogrify module brings the typographic refinements of Typogrify to Drupal. It provides a text filter and a Twig filter.

The typogrify Twig filter can be used to bypass the Twig auto-escape feature, leading to a persistent Cross Site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that it is only exposed when the twig filter is specifically used in a template to render content.

File Entity (fieldable files) - Moderately critical - Cross Site Scripting, Access bypass - SA-CONTRIB-2024-001

Date: 
2024-January-10
Security risk: 
Moderately critical 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All

File entity provides interfaces for managing files. It also extends the core file entity, allowing files to be fieldable, grouped into types, viewed (using display modes) and formatted using field formatters.

The module previously did not sufficiently validate files under the scenario of a file replacement leading to multiple exploit paths including persistent Cross Site Scripting.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission to edit files.

Data Visualisation Framework - Moderately critical - Cross Site Scripting - SA-CONTRIB-2023-055

Date: 
2023-December-20
Security risk: 
Moderately critical 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All

This module allows you to turn various data sources (Eg CSV or JSON file) into interactive visualisation. The DVF module provides a field (storage, widget & formatter) that can be added to any entity.

This module uses two third-party JS libraries having from low to medium vulnerabilities. One of the vulnerabilities is a Cross Site Scripting vulnerability that may affect Drupal sites as a Persistent Cross Site Scripting vulnerability (i.e. not reflected). This release updates the libraries.

Group - Less critical - Access bypass - SA-CONTRIB-2023-054

Date: 
2023-December-06
Security risk: 
Less critical 8∕25 AC:Complex/A:User/CI:Some/II:None/E:Theoretical/TD:Uncommon

The Group module has the ability to make content private to specific groups. When viewing a list of entities, e.g. nodes, a visitor should only see those entities that are either not attached to a group or that they have group access to.

The module doesn't sufficiently enforce list access under the scenario where two users have the same outsider and insider permissions, but are members of different groups without any individual roles being assigned to said memberships. In such a scenario, the permissions hash for both will be the same even though it should differ.

Xsendfile - Moderately critical - Access bypass - SA-CONTRIB-2023-053

Date: 
2023-November-29
Security risk: 
Moderately critical 13∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:All

The Xsendfile module enables fast transfer for private files in Drupal.

In order to control private file downloads, the module overrides ImageStyleDownloadController, for which a vulnerability was disclosed in SA-CORE-2023-005. The Xsendfile module was still based on an insecure version of ImageStyleDownloadController.

Pages

Subscribe with RSS Subscribe to Security advisories