Category Archives: Drupal

Drupal Security Advisories

Twilio – Moderately Critical – Access bypass – SA-CONTRIB-2015-157

Description

This module provides hooks and rules integration to leverage the Twilio API to send/receive phone calls and text messages.

The module relies on existing permissions for providing administration which can lead to untrusted users having access to perform actions that may not be intended.

This vulnerability is mitigated by the fact that an attacker must have access to a session with the role that has the permission “access administration pages”.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.

Versions affected

  • Twilio 7.x-1.x versions prior to 7.x-1.11

Drupal core is not affected. If you do not use the contributed Twilio module, there is nothing you need to do.

Solution

Install the latest version:

Grant the permission “administer twilio” to any roles that should be able to administer the Twilio module.

Also see the Twilio project page.

Reported by

Fixed by

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: 

Colorbox – Access bypass – Less Critical – SA-CONTRIB-2015-156

Description

This module allows for integration of Colorbox, a jQuery lightbox plugin, into Drupal.

The module allows unprivileged users to add unexpected content to a Colorbox, including content from external sites. This allows an unprivileged user to deface a site.

This vulnerability is mitigated by the fact that an attacker must have permission to post comments with a text format that allows links.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.

Versions affected

  • Colorbox 7.x-2.x versions prior to 7.x-2.10.

Drupal core is not affected. If you do not use the contributed Colorbox module, there is nothing you need to do.

Solution

Install the latest version:

Also see the Colorbox project page.

Reported by

Fixed by

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: 

Entity Registration – Moderately Critical – Information Disclosure – SA-CONTRIB-2015-155

Description

This module enables you to manage registrations for events.

The module doesn’t sufficiently protect information about who is registered to attend specific events when anonymous users are granted a permission that is commonly recommended when allowing anonymous registrations.

This vulnerability is mitigated by the fact that anonymous users must have the permission “Register other accounts.”

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.

Versions affected

  • Entity Registration 7.x-1.x versions prior to 7.x-1.5.

Drupal core is not affected. If you do not use the contributed Entity Registration module, there is nothing you need to do.

Solution

Install the latest version:

Note on releases: the security bug was fixed in the 7.x-1.5 release, however that release included many other bug fixes and features. The 7.x-1.6 release is intended to fix a critical, non-security bug in the 7.x-1.5 release.

Update permissions configuration:

  • Remove the “Register other accounts” permission for anonymous users or other unprivileged roles
  • If needed, add the “Register Self” permission for anonymous users and other unprivileged roles

Also see the Entity Registration project page.

Reported by

Fixed by

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Stickynote – Cross Site Scripting (XSS) – Moderately Critical – SA-CONTRIB-2015-154

Description

This module enables you to create notes on a page inside a block.

The module doesn’t sufficiently sanitize the note text on the admin listing page.

This vulnerability is mitigated by the fact that an attacker must have a role with a permission to create or edit a stickynote.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.

Versions affected

  • Stickynote 7.x-1.x versions prior to 7.x-1.3.

Drupal core is not affected. If you do not use the contributed stickynote module, there is nothing you need to do.

Solution

Install the latest version.

Also see the stickynote project page.

Reported by

Fixed by

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: 

Taxonomy Find – Unsupported – SA-CONTRIB-2015-153

Description

This module enables you to add a simple search interface to lookup taxonomy terms by name.

The module doesn’t sufficiently sanitize output of taxonomy vocabulary names and term names.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission “Administer vocabularies and terms” or the ability to add or edit nodes or entities with taxonomy fields attached.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.

Versions affected

  • MODULE 6.x-2.x versions up to 6.x-1.2.
  • MODULE 7.x-2.x versions up to 7.x-1.0.

Drupal core is not affected. If you do not use the contributed Taxonomy Find module, there is nothing you need to do.

Solution

If you use the Taxonomy Find module you should uninstall it.

Also see the Taxonomy Find project page.

Reported by

  • Matt Vance provisional member of the Drupal Security Team

Fixed by

Not applicable.

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: 

User Dashboard – SQL Injection – Critical – SA-CONTRIB-2015-152

Description

Module contains SQL Injection vulnerabilities.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.

Versions affected

  • user_dashboard 7.x versions prior to 7.x-1.4

Drupal core is not affected. If you do not use the contributed UserDashboard module, there is nothing you need to do.

Solution

Install the latest version.

  • If you use the User Dashboard module for Drupal 7.x, upgrade to 7.x-1.4

Also see the UserDashboard project page.

Reported by

Fixed by

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: 

Scald – Moderately Critical – Information Disclosure – SA-CONTRIB-2015-151

Description

This module enables you to easily manage your media assets and re-use them in all your content.

The module provided a “debug” context that gave access to all the atom properties, including all the fields attached to this atom, without applying the corresponding field restrictions.

This vulnerability is mitigated by the fact that only sites that added fields to an atom type and then restricted access to those fields are vulnerable.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.

Versions affected

  • Scald 7.x-1.x versions prior to 7.x-1.5.

Drupal core is not affected. If you do not use the contributed Scald: Media Management made easy module, there is nothing you need to do.

Solution

Install the latest version:

  • If you use the Scald module for Drupal 7.x, upgrade to Scald 7.x-1.5

Also see the Scald: Media Management made easy project page.

Reported by

Fixed by

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: 

CMS Updater – Moderately Critical – Multiple vulnerabilities – SA-CONTRIB-2015-150

Description

CMS Updater allows to update Drupal core automatically with a subscription service.

Access bypass
The module does not sufficiently protect the settings page allowing any user with the permission “access administration pages” to change settings.

This vulnerability is mitigated by the fact that an attacker must have the “access administration pages” permission on the site.

Cross Site Scripting (XSS)
The module does not sanitize user provided text on the configuration page thereby exposing a cross site scripting vulnerability.

There are no mitigating factors for the cross site scripting.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.

Versions affected

  • CMS Updater 7.x-1.x versions prior to 7.x-1.3.

Drupal core is not affected. If you do not use the contributed CMS Updater module, there is nothing you need to do.

Solution

Install the latest version:

Also see the CMS Updater project page.

Reported by

Fixed by

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: 

amoCRM – Moderately Critical – Cross Site Scripting – SA-CONTRIB-2015-149

Description

This module enables you to integrate with amoCRM service using webhooks.

The module does not sufficiently sanitize the logged data when malicious POST data is received.

This vulnerability is mitigated by the fact that a module such “Database logging” (dblog) must be enabled which displays log messages in a HTML context.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.

Versions affected

  • amoCRM 7.x-1.x versions prior to 7.x-1.2.

Drupal core is not affected. If you do not use the contributed amoCRM module, there is nothing you need to do.

Solution

Install the latest version:

  • If you use the amoCRM module for Drupal 7.x, upgrade to amoCRM 7.x-1.2

Also see the amoCRM project page.

Reported by

Fixed by

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: 

Drupal 7 driver for SQL Server and SQL Azure – Moderately Critical – SQL Injection – SA-CONTRIB-2015-148

Description

Drupal 7 driver for SQL Server and SQL Azure module has a SQL injection vulnerability.

Certain characters aren’t properly escaped by the Drupal database API. A malicious user may be able to access restricted information by performing a specially-crafted search.

Only sites that use contrib or custom modules which rely on the db_like() function may be affected.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.

Versions affected

  • Drupal 7 driver for SQL Server and SQL Azure 7.x-1.x versions prior to 7.x-1.4

Drupal core is not affected. If you do not use the contributed Drupal 7 driver for SQL Server and SQL Azure module, there is nothing you need to do.

Solution

Install the latest version:

Although a 7.x-1.4 version has been released the 7.x-1.x branch is currently unsupported and not maintained.

Also see the Drupal 7 driver for SQL Server and SQL Azure project page.

Reported by

Fixed by

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: