MenuMenu

Feed aggregator

Time Tracker - Moderately Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-135

Project Security Advisories - Wed, 07/22/2015 - 11:54am
Description

This module enables you to track time on entities and comments.

The module doesn't sufficiently filter notes added to time entries, leading to an XSS/JavaScript injection vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Add Time Tracker Entries".

The module doesn't sufficiently filter activities used to categorize time tracker entries. This vulnerability is mitigated by the fact that an attacker must have a role with the "Administer Time Tracker" permission. This role has also been properly marked as "restrict access".

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • Time Tracker 7.x-1.x versions prior to 7.x-1.4.

Drupal core is not affected. If you do not use the contributed Time Tracker module, there is nothing you need to do.

Solution

Install the latest version:

Also see the Time Tracker project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: Drupal 7.x

OSF for Drupal - Critical - Multiple vulnerabilities - SA-CONTRIB-2015-134

Project Security Advisories - Wed, 07/22/2015 - 11:46am
Description

The Open Semantic Framework (OSF) for Drupal is a middleware layer that allows structured data (RDF) and associated vocabularies (ontologies) to "drive" tailored tools and data displays within Drupal.

The module is vulnerable to reflected Cross Site Scripting (XSS) because it did not sufficiently filter user input values in some administration pages. An attacker could exploit this vulnerability by making other users visit a specially-crafted URL. Only sites with OSF Ontology module enabled are affected.

Additionally, the module is vulnerable to Arbitrary file deletion. A malicious user can cause an administrator to delete files by getting their browser to make a request to a specially-crafted URL. Only sites with OSF Ontology and OSF Import modules enabled are affected.

Also, some forms were vulnerable to Cross Site Request Forgery (CSRF). An attacker could create new OSF datasets by getting an administrator's browser to make a request to a specially-crafted URL. Only sites with OSF Import module enabled are affected.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • OSF 7.x-3.x versions prior to 7.x-3.1.

Drupal core is not affected. If you do not use the contributed OSF for Drupal module, there is nothing you need to do.

Solution

Install the latest version:

  • If you use the OSF for Drupal module for Drupal 7.x, upgrade to OSF 7.x-3.1

Also see the OSF for Drupal project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: Drupal 7.x

Path Breadcrumbs - Less Critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-133

Project Security Advisories - Wed, 07/15/2015 - 12:30pm
Description

This module enables you to configure breadcrumbs for any Drupal page.

The module didn't sufficiently filter user input values the in administration interface.

This vulnerability was mitigated by the fact that an attacker must have a role with the permission "Administer Path Breadcrumbs".

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • Path Breadcrumbs 7.x-3.x versions prior to 7.x-3.3

Drupal core is not affected. If you do not use the contributed Path Breadcrumbs module,
there is nothing you need to do.

Solution

Install the latest version:

Also see the Path Breadcrumbs project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: Drupal 7.x

Administration Views - Critical - Information Disclosure - SA-CONTRIB-2015-132

Project Security Advisories - Wed, 07/08/2015 - 1:39pm
Description

Administration Views module replaces overview/listing pages with actual views for superior usability.

The module does not check access properly under certain circumstances. Anonymous users could get access to read information they should not have access to.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • Administration Views 7.x-1.x versions prior to 7.x-1.5.

Drupal core is not affected. If you do not use the contributed Administration Views module, there is nothing you need to do.

Solution

Install the latest version:

Also see the Administration Views project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: Drupal 7.x

Views Bulk Operations - Moderately critical - Access Bypass - SA-CONTRIB-2015-131

Project Security Advisories - Wed, 07/01/2015 - 11:35am
Description

The Views Bulk Operations module enables you to add bulk operations to administration views, executing actions on multiple selected rows.

The module doesn't sufficiently guard user entities against unauthorized modification. If a user has access to a user account listing view with VBO enabled (such as admin/people when the administration_views module is used), they will be able to edit their own account and give themselves a higher role (such as "administrator") even if they don't have the "'administer users'" permission.

This vulnerability is mitigated by the fact that an attacker must have access to such a user listing page and that the bulk operation for changing Roles is enabled.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • Views Bulk Operations 7.x-3.x versions prior to 7.x-3.3.
  • Views Bulk Operations 6.x-1.x versions.

Drupal core is not affected. If you do not use the contributed Views Bulk Operations (VBO) module, there is nothing you need to do.

Solution

Install the latest version:

  • If you use the Views Bulk Operations module for Drupal 7.x, upgrade to Views Bulk Operations 7.x-3.3
  • If you use the Views Bulk Operations module for Drupal 6.x, uninstall the module.

Also see the Views Bulk Operations (VBO) project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: Drupal 6.xDrupal 7.x

Migrate - Less critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-130

Project Security Advisories - Wed, 07/01/2015 - 11:21am
Description

This module enables you to manage migration processes through the administrative UI.

The module doesn't sufficiently sanitize destination field labels thereby exposing a Cross Site Scripting vulnerability (XSS).

This vulnerability is mitigated by the fact that an attacker must have a role
with permission to create/edit fields (such as "administer taxonomy"), or be able to modify source data being imported by an administrator. Furthermore, the migrate_ui submodule must be enabled.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • Migrate 7.x-2.x versions prior to 7.x-2.8.

Drupal core is not affected. If you do not use the contributed Migrate module, there is nothing you need to do.

Solution

Install the latest version:

  • If you use the migrate module's migrate_ui submodule for Drupal 7.x, upgrade to Migrate 7.x-2.8

Also see the Migrate project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: Drupal 7.x

Shibboleth authentication - Moderately critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-129

Project Security Advisories - Wed, 06/24/2015 - 1:02pm
Description

Shibboleth authentication module allows users to log in and get permissions based on federated (SAML2) authentication.

The module didn't filter the text that is displayed as a login link.

This vulnerability was mitigated by the fact that an attacker must have a role with the permission Administer blocks.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • Shibboleth authentication 6.x-4.x versions prior to 6.x-4.2.
  • Shibboleth authentication 7.x-4.x versions prior to 7.x-4.2.

Drupal core is not affected. If you do not use the contributed Shibboleth authentication module, there is nothing you need to do.

Solution

Also see the Shibboleth authentication project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: Drupal 6.xDrupal 7.x

me aliases - Moderately Critical - Access Bypass - SA-CONTRIB-2015-128

Project Security Advisories - Wed, 06/24/2015 - 11:06am
Description

'me aliases' module provides shortcut paths to current user's pages, eg user/me, blog/me, user/me/edit, tracker/me etc.

The view user argument handler for the 'me' module has an access bypass vulnerability where it does not check the supplied argument against the current user. This allows any user to access the content served by the view by substituting 'me' in the URL with a user id even when they don't have permission to access the content.

These only affects Views which use the Views 'me' user argument handler.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • me aliases 7.x-1.x versions prior to 7.x-1.2
  • me aliases 6.x-2.x versions prior to 6.x-2.10

Drupal core is not affected. If you do not use the contributed me aliases module, there is nothing you need to do.

Solution

Install the latest version:

  • If you use the 'me aliases' module for Drupal 7.x, upgrade to me 7.x-1.2
  • If you use the 'me aliases' module for Drupal 6.x, upgrade to me 6.x-2.10

Also see the me aliases project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: Drupal 6.xDrupal 7.x

HybridAuth Social Login - Less Critical - Access bypass - SA-CONTRIB-2015-127

Project Security Advisories - Wed, 06/24/2015 - 10:55am
Description

The HybridAuth Social Login module enables you to allow visitors to authenticate or login to a Drupal site using their identities from social networks like Facebook or Twitter.

The module allows account creation through social login when the configuration is set to allow user registration by administrators only.

This vulnerability is mitigated by the fact that a site must be configured to allow user registration by administrators only and that authenticated user accounts can access sensitive data that would otherwise not be shown to anonymous users.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • HybridAuth Social Login 7.x-2.x versions prior to 7.x-2.13.

Drupal core is not affected. If you do not use the contributed HybridAuth Social Login module, there is nothing you need to do.

Solution

Install the latest version:

Also see the HybridAuth Social Login project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: Drupal 7.x

Content Construction Kit (CCK) - Less Critical - Open Redirect - SA-CONTRIB-2015-126

Project Security Advisories - Wed, 06/17/2015 - 2:50pm
Description

The Content Construction Kit (CCK) project is a set of modules that allows you to add custom fields to nodes using a web browser.

CCK uses a "destinations" query string parameter in URLs to redirect users to new destinations after completing an action on a few administration pages. Under certain circumstances, malicious users can use this parameter to construct a URL that will trick users into being redirected to a 3rd party website, thereby exposing the users to potential social engineering attacks.

See also: SA-CORE-2015-002

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • Content Construction Kit (CCK) 6.x-2.x versions prior to 6.x-2.10.

Drupal core is not affected. If you do not use the contributed Content Construction Kit (CCK) module, there is nothing you need to do.

Solution

Install the latest version:

Also see the Content Construction Kit (CCK) project page.

Reported by Fixed by
  • Pere Orga of the Drupal Security Team
  • Neil Drumm, module maintainer and member of the Drupal Security Team
Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: Drupal 6.x

Acquia Cloud Site Factory Connector - Less Critical - Open Redirect - SA-CONTRIB-2015-125

Project Security Advisories - Wed, 06/17/2015 - 2:41pm
Description

Acquia Cloud Site Factory provides an environment and a robust set of tools that simplify management of many Drupal sites, allowing you to quickly deliver and manage any number of websites.

The module ships with a modified version of the core Overlay JavaScript file, which is vulnerable to an open redirect attack (see SA-CORE-2015-002).

Only sites with the Overlay module enabled are vulnerable.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • Acquia Cloud Site Factory 7.x-1.x versions prior to 7.x-1.14

Drupal core is not affected. If you do not use the contributed Acquia Cloud Site Factory Connector module, there is nothing you need to do.

Solution

Install the latest version:

Also see the Acquia Cloud Site Factory Connector project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: Drupal 7.x

LABjs - Less Critical - Open Redirect - SA-CONTRIB-2015-124

Project Security Advisories - Wed, 06/17/2015 - 2:36pm
Description

The LABjs module integrates LABjs with Drupal for web performance optimization.

The module ships with a modified version of the core Overlay JavaScript file, which is vulnerable to an open redirect attack (see SA-CORE-2015-002).

Only sites with the Overlay module enabled are vulnerable.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • LABjs 7.x-1.x versions prior to 7.x-1.7.

Drupal core is not affected. If you do not use the contributed LABjs module, there is nothing you need to do.

Solution

Install the latest version:

  • If you use the LABjs module for Drupal 7.x, upgrade to LABjs 7.x-1.7.

Also see the LABjs project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: Drupal 7.x

jQuery Update - Less Critical - Open Redirect - SA-CONTRIB-2015-123

Project Security Advisories - Wed, 06/17/2015 - 2:33pm
Description

The jQuery Update module enables you to update jQuery on your site.

The module ships with a modified version of the core Overlay JavaScript file, which is vulnerable to an open redirect attack (see SA-CORE-2015-002).

Only sites with the Overlay module enabled are vulnerable.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • jQuery Update 7.x-2.x versions prior to 7.x-2.6

Drupal core is not affected. If you do not use the contributed jQuery Update module, there is nothing you need to do.

Solution

Install the latest version:

Also see the jQuery Update project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: Drupal 7.x

Drupal Core - Critical - Multiple Vulnerabilities - SA-CORE-2015-002

Core Security Advisories - Wed, 06/17/2015 - 12:12pm
Description Impersonation (OpenID module - Drupal 6 and 7 - Critical)

A vulnerability was found in the OpenID module that allows a malicious user to log in as other users on the site, including administrators, and hijack their accounts.

This vulnerability is mitigated by the fact that the victim must have an account with an associated OpenID identity from a particular set of OpenID providers (including, but not limited to, Verisign, LiveJournal, or StackExchange).

Open redirect (Field UI module - Drupal 7 - Less critical)

The Field UI module uses a "destinations" query string parameter in URLs to redirect users to new destinations after completing an action on a few administration pages. Under certain circumstances, malicious users can use this parameter to construct a URL that will trick users into being redirected to a 3rd party website, thereby exposing the users to potential social engineering attacks.

This vulnerability is mitigated by the fact that only sites with the Field UI module enabled are affected.

Drupal 6 core is not affected, but see the similar advisory for the Drupal 6 contributed CCK module: SA-CONTRIB-2015-126

Open redirect (Overlay module - Drupal 7 - Less critical)

The Overlay module displays administrative pages as a layer over the current page (using JavaScript), rather than replacing the page in the browser window. The Overlay module does not sufficiently validate URLs prior to displaying their contents, leading to an open redirect vulnerability.

This vulnerability is mitigated by the fact that it can only be used against site users who have the "Access the administrative overlay" permission, and that the Overlay module must be enabled.

Information disclosure (Render cache system - Drupal 7 - Less critical)

On sites utilizing Drupal 7's render cache system to cache content on the site by user role, private content viewed by user 1 may be included in the cache and exposed to non-privileged users.

This vulnerability is mitigated by the fact that render caching is not used in Drupal 7 core itself (it requires custom code or the contributed Render Cache module to enable) and that it only affects sites that have user 1 browsing the live site. Exposure is also limited if an administrative role has been assigned to the user 1 account (which is done, for example, by the Standard install profile that ships with Drupal core).

CVE identifier(s) issued
  • Impersonation (OpenID module - Drupal 6 and 7): CVE-2015-3234
  • Open redirect (Field UI module - Drupal 7): CVE-2015-3232
  • Open redirect (Overlay module - Drupal 7: CVE-2015-3233
  • Information disclosure (Render cache system - Drupal 7): CVE-2015-3231
Versions affected
  • Drupal core 6.x versions prior to 6.36
  • Drupal core 7.x versions prior to 7.38
Solution

Install the latest version:

Also see the Drupal core project page.

Reported by

Impersonation in the OpenID module:

Open redirect in the Field UI module:

Open redirect in the Overlay module:

Information disclosure in the render cache system:

Fixed by

Impersonation in the OpenID module:

Open redirect in the Field UI module:

Open redirect in the Overlay module:

Information disclosure in the render cache system:

Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: Drupal 6.xDrupal 7.x

Administration Views - Moderately Critical - Access Bypass - SA-CONTRIB-2015-122

Project Security Advisories - Wed, 06/17/2015 - 11:58am
Description

This module replaces administrative overview/listing pages with Views for improved usability.

When combined with other contributed or custom modules, the Administration Views module improperly grants users access to administration pages including the permissions page.

This vulnerability is mitigated by the fact that it does not appear in the module itself, but only when combined with select other custom or contributed modules.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • Administration Views 7.x-1.x versions prior to 7.x-1.4.

Drupal core is not affected. If you do not use the contributed Administration Views module, there is nothing you need to do.

Solution

Install the latest version:

Also see the Administration Views project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: Drupal 7.x

The eXtensible Catalog (XC) Drupal Toolkit - Critical - Cross Site Request Forgery (CSRF) - Unsupported - SA-CONTRIB-2015-121

Project Security Advisories - Wed, 06/17/2015 - 11:27am
Description

The eXtensible Catalog Drupal Toolkit is a set of Drupal modules to harvest records of the XC Schema format from a Metadata Services Toolkit (MST).

The XC NCIP Provider module doesn't sufficiently protect some URLs against CSRF. A malicious user can cause a user with "administer ncip providers" permission to alter NCIP providers by getting their browser to make a request to a specially-crafted URL.

This vulnerability is mitigated by the fact that only sites that have the XC NCIP Provider module enabled are affected.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • All versions of The eXtensible Catalog (XC) Drupal Toolkit

Drupal core is not affected. If you do not use the contributed The eXtensible Catalog (XC) Drupal Toolkit module, there is nothing you need to do.

Solution

If you use The eXtensible Catalog (XC) Drupal Toolkit you should uninstall it.

Also see the The eXtensible Catalog (XC) Drupal Toolkit project page.

Reported by Fixed by

Not applicable.

Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: Drupal 6.xDrupal 7.x

Inline Entity Form - Less critical - Cross Site Scripting (XSS) - SA-CONTRIB-2015-120

Project Security Advisories - Wed, 06/17/2015 - 11:13am
Description

The Inline Entity Form module provides a field widget for inline management (creation, modification, removal) of referenced entities.

The module doesn't sufficiently sanitize user supplied text, thereby exposing a Cross Site Scripting vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to create/edit fields.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • Inline Entity Form 7.x-1.x versions prior to 7.x-1.6.

Drupal core is not affected. If you do not use the contributed Inline Entity Form module, there is nothing you need to do.

Solution

Install the latest version:

Also see the Inline Entity Form project page.

Reported by
  • Matt Vance, provisional member of the Drupal Security Team
Fixed by
  • Matt Vance, provisional member of the Drupal Security Team
Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: Drupal 7.x

Apache Solr Real-Time - Critical - Access Bypass - SA-CONTRIB-2015-119

Project Security Advisories - Wed, 06/17/2015 - 10:48am
Description

This module allows content-changes to be committed to Apache Solr in real-time.

The module doesn't check the status of an entity being indexed which means that unpublished content will get indexed by Solr and the title and partial content may be exposed to any user who has permission to search site content.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • Apache Solr Real-Time 7.x-2.x versions prior to 7.x-2.2.

Drupal core is not affected. If you do not use the contributed Apache Solr Real-Time module, there is nothing you need to do.

Solution

Install the latest version:

Also see the Apache Solr Real-Time project page.

Reported by Fixed by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: Drupal 7.x

HTTP Strict Transport Security - Moderately Critical - Logical Error - SA-CONTRIB-2015-118

Project Security Advisories - Wed, 06/17/2015 - 10:18am
Description

The contributed HSTS module makes it easy for site administrators to implement HTTP Strict Transport Security (HSTS) by setting the Strict-Transport-Security header on each page generated by Drupal.

HSTS module provides a configuration UI for the HSTS "include subdomains" directive, which indicates that the browser should apply the HSTS policy to all subdomains on the site's domain.

HSTS module did not implement the "include subdomains" directive correctly (it is misspelled as include_subdomains rather than includeSubDomains). As a result, the HSTS policy was not applied to subdomains as site administrators had expected.

This vulnerability is mitigated by the fact that only subdomains where HSTS was expected to be enabled are affected and an attacker would still need to execute a man-in-the-middle attack to exploit the issue.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • HSTS 7.x-1.x versions prior to 7.x-1.2.
  • HSTS 6.x-1.x versions prior to 6.x-1.1.

Drupal core is not affected. If you do not use the contributed HTTP Strict Transport Security module, there is nothing you need to do.

Solution

Install the latest version:

  • If you use the HSTS module for Drupal 7.x, upgrade to HSTS 7.x-1.2
  • If you use the HSTS module for Drupal 6.x, upgrade to HSTS 6.x-1.1

Also see the HTTP Strict Transport Security project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: Drupal 6.xDrupal 7.x

Novalnet Payment Module Drupal Commerce - Critical - SQL Injection - Unsupported - SA-CONTRIB-2015-117

Project Security Advisories - Wed, 06/03/2015 - 12:24pm
Description

This module enables you add the Novalnet payment service provider to Drupal Commerce.

The module fails to sanitize a database query by not using the database API properly, thereby leading to a SQL Injection vulnerability. Since the affected path is not protected against CSRF, a malicious user can exploit this vulnerability by triggering a request to a specially-crafted URL.

This vulnerability is mitigated by the fact that the malicious request must come from a specific Novalnet IP address.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.
Versions affected
  • All versions of Novalnet Payment Module Drupal Commerce module

Drupal core is not affected. If you do not use the contributed Novalnet Payment Module Drupal Commerce module, there is nothing you need to do.

Solution

If you use the Novalnet Payment Module Drupal Commerce module you should uninstall it.

Also see the Novalnet Payment Module Drupal Commerce project page.

Reported by Fixed by

Not applicable.

Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: Drupal 7.x

Pages