Security advisories

The CKEditor 4 LTS - WYSIWYG HTML editor module uses the CKEditor library for WYSIWYG editing. CKEditor has released a security update that on certain configurations may impact the Drupal module that bundles and integrates this code.

The vulnerability is mitigated by the fact it requires:

The Entity Delete Log module tracks the deletion of configured entity types, such as node or comments.

It does not add sufficient permission to the log report page, allowing an attacker to view information from deleted entities.

Open Social is a Drupal distribution for online communities.

The included optional social_group_flexible_group module doesn't sufficiently validate group updates. The lack of validation makes it possible to have content inside the group changing it's visibility, which could lead to that content being shown to a broader audience than intended.

This vulnerability is mitigated by the fact the module social_group_flexible_group needs to be enabled.

This module enables you to allow and/or require users to use a second authentication method in addition to password authentication.

In some cases, the module allows users to log in with an authentication plugin that an administrator has disabled.

This vulnerability is mitigated by the fact that an attacker must obtain a valid first-factor login credential, that an administrator must enable and then disable an authentication plugin, and that an attacker must obtain the valid second factor credential for the disabled plugin.