Most recent entries from drupal

DRUPAL-CONTRIB-2023-030

Wed, 12 Jul 2023 18:19:42 +0000

Affected: Packagist:https://packages.drupal.org/8: drupal/tfa

This module enables you to allow and/or require users to use a second authentication method in addition to password authentication.

The module doesn't sufficiently ensure all core login routes, including the password reset page, require a second factor credential.

This vulnerability is mitigated by the fact that an attacker must obtain a first-factor login credential.

DRUPAL-CONTRIB-2023-032

Wed, 26 Jul 2023 19:19:38 +0000

Affected: Packagist:https://packages.drupal.org/8: drupal/minifyhtml

Carefully crafted input by an attacker will not be sanitized by this module, which can result in a script injection.

DRUPAL-CONTRIB-2023-031

Wed, 26 Jul 2023 19:15:46 +0000

Affected: Packagist:https://packages.drupal.org/8: drupal/symfony_mailer

The module doesn’t sufficiently protect against malicious links, which means an attacker can trick an administrator into performing unwanted actions.

This vulnerability is mitigated by the fact that the set of unwanted actions is limited to specific configurations.

DRUPAL-CONTRIB-2023-028

Wed, 28 Jun 2023 17:21:37 +0000

Affected: Packagist:https://packages.drupal.org/8: drupal/expandable_formatter

This module enables you to render a field in an expandable/collapsible region.

The module doesn't sufficiently sanitize the field content when displaying it to an end user.

This vulnerability is mitigated by the fact that an attacker must have a role capable of creating content that uses the field formatter.

DRUPAL-CONTRIB-2023-027

Wed, 28 Jun 2023 17:15:03 +0000

Affected: Packagist:https://packages.drupal.org/8: drupal/libraries_ui

This module enables a UI to display all libraries provided by modules and themes on the Drupal site.

The module doesn't sufficiently protect the libraries reporting page. It curently is using the 'access content' permission and not a proper administrative/access permission.

The vulnerability/library information can be exploited by simply visiting/knowing the url of the reporting page. The solution is to protect the page via a module specific permission that must be granted by an administrative user.

DRUPAL-CONTRIB-2023-029

Wed, 28 Jun 2023 17:34:47 +0000

Affected: Packagist:https://packages.drupal.org/8: drupal/tacjs

This module enables sites to comply with the European cookie law using tarteaucitron.js.

The module doesn't sufficiently filter user-supplied text leading to a Cross Site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker needs additional permissions. The vulnerability can be exploited by an attacker with a role with the permission "administer tacjs" regardless of other configurations.

DRUPAL-CONTRIB-2023-033

Wed, 02 Aug 2023 18:59:27 +0000

Affected: Packagist:https://packages.drupal.org/8: drupal/matomo

This module enables you to add the Matomo web statistics tracking system to your website.

The module does not check the Matomo JS code loaded on the website. So a user could configure the module to load JS from a malicious website.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer matomo" or "administer matomo tag manager" (D8+ only) to access the settings forms where this can be configured.

DRUPAL-CONTRIB-2023-024

Wed, 28 Jun 2023 17:03:36 +0000

Affected: Packagist:https://packages.drupal.org/8: drupal/gridstack

This module enables you to create dynamic layouts and add sample color palettes for color selection hints via its UI.

The module doesn't sufficiently sanitize the module's settings in certain scenarios leading to a Cross Site Scripting vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with the permissions "administer gridstack".

DRUPAL-CONTRIB-2023-026

Wed, 28 Jun 2023 17:11:07 +0000

Affected: Packagist:https://packages.drupal.org/8: drupal/search_autocomplete

This module enables you to use complex autocompletion in forms.

The module doesn't sufficiently filter text in the data it exposes, allowing a malicious user to enter specially crafted tags to exploit a Cross Site Scripting (XSS) attack.

This vulnerability is mitigated by the fact that an attacker must have a role which allows them to publish the kind of data used in the autocomplete (for instance create nodes if the tool is used to search nodes, comments if the tool is used to search comments, etc...)

DRUPAL-CONTRIB-2023-023

Wed, 28 Jun 2023 17:02:13 +0000

Affected: Packagist:https://packages.drupal.org/8: drupal/gdpr_alert

This module enables you to define configurable GDPR alert messages.

The module doesn't sufficiently filter user-supplied text leading to a Cross Site Scripting (XSS) vulnerability.