Category Archives: Drupal

Drupal Security Advisories

pass2pdf – Critical – Information Disclosure – Unsupported – SA-CONTRIB-2015-109

Description

This module allows you to let users set a password upon registering, and have the password emailed to the user in a PDF file.

The module has an Information Disclosure vulnerability. The generated PDF files are not protected. The user passwords are exposed to anonymous users.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.

Versions affected

  • All versions of pass2pdf module

Drupal core is not affected. If you do not use the contributed pass2pdf module,
there is nothing you need to do.

Solution

If you use the pass2pdf module you should uninstall it.

Also see the pass2pdf project page.

Reported by

Fixed by

Not applicable.

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: 

Mobile sliding menu – Less Critical – Cross Site Scripting (XSS) – SA-CONTRIB-2015-108

Description

The mobile sliding menu module integrates the mmenu jQuery plugin for creating slick, app look-alike sliding menus for your mobile website.

The module doesn’t sufficiently sanitize user supplied text, thereby exposing a Cross Site Scripting vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission “administer menu”.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.

Versions affected

  • Mobile sliding menu 7.x-2.x versions prior to 7.x-2.1.

Drupal core is not affected. If you do not use the contributed Mobile sliding menu module,
there is nothing you need to do.

Solution

Install the latest version:

Also see the Mobile sliding menu project page.

Reported by

Fixed by

Coordinated by

  • Aaron Ott provisional member of the Drupal Security Team

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: 

Webform Matrix Component – Moderately Critical – Cross Site Scripting (XSS) – SA-CONTRIB-2015-107

Description

The Webform Matrix Component module is an extension of the Webform module that adds Matrix and Table components.

The module doesn’t sufficiently sanitize user supplied text, thereby exposing a Cross Site Scripting vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with permission to create/edit webform nodes.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.

Versions affected

  • Webform Matrix Component 7.x-4.x versions prior to 7.x-4.13.

Drupal core is not affected. If you do not use the contributed Webform Matrix Component module, there is nothing you need to do.

Solution

Install the latest version:

Also see the Webform Matrix Component project page.

Reported by

  • Matt Vance provisional member of the Drupal Security Team

Fixed by

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: 

Entityform Block – Moderately Critical – Access Bypass – SA-CONTRIB-2015-106

Description

This module enables you to display an entityform as a block.

The module doesn’t sufficiently check permissions on the entityform under scenarios where the form is locked to a certain role.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.

Versions affected

  • Entityform Block 7.x-1.x versions prior to 7.x-1.3.

Drupal core is not affected. If you do not use the contributed Entityform block module,
there is nothing you need to do.

Solution

Install the latest version:

Also see the Entityform block project page.

Reported by

Fixed by

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: 

Video Consultation – Moderately Critical – Cross Site Scripting (XSS) – Unsupported – SA-CONTRIB-2015-105

Description

Video Consultation module integrates VideoWhisper Video Consultation software with Drupal.

The module doesn’t sufficiently sanitize user supplied text, thereby exposing a Cross Site Scripting vulnerability.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.

Versions affected

All versions of Video Consultation module.

Drupal core is not affected. If you do not use the contributed Video Consultation module, there is nothing you need to do.

Solution

If you use the Video Consultation module you should uninstall it.

Also see the Video Consultation project page.

Reported by

Fixed by

Not applicable.

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: 

Dynamic display block – Less Critical – Access bypass – Unsupported – SA-CONTRIB-2015-104

Description

This module enables you to showcase featured content at a prominent place on the front page of the site in an attractive way.

The module doesn’t sufficiently protect access to content a user has no access to. In certain scenarios a user with the “administer ddblock” permission can see titles of content for which this user has no access.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission “administer ddblock” permission.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance with Drupal Security Team processes.

Versions affected

All versions of Dynamic display block module.

Drupal core is not affected. If you do not use the contributed Dynamic display block module, there is nothing you need to do.

Solution

If you use the Dynamic display block module you should uninstall it.

Also see the Dynamic display block project page.

Reported by

Fixed by

Not applicable.

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: 

Views – Critical – Access Bypass – SA-CONTRIB-2015-103

Description

The Views module provides a flexible method for Drupal site designers to control how lists and tables of content, users, taxonomy terms and other data are presented.

Access bypass due cache inconsistency

Due to an issue in the caching mechanism of Views it’s possible that configured filters loose their effect.
This can lead to exposure of content that otherwise would be hidden from visitors.
This vulnerability is mitigated by the fact that it can’t be exploited directly but occurs when certain prerequisites meet.
Systems that use in-memory cache backends like redis / memcache are more likely to be affected by this issue. This is due the common strategy used to free cache space if the configured memory limit of the cache is reached.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.

Versions affected

  • Views 7.x-3.x versions from 7.x-3.5 to 7.x-3.10.

Drupal core is not affected. If you do not use the contributed Views module,
there is nothing you need to do.

Solution

Install the latest version:

  • If you use the Views module for Drupal 7.x, upgrade to Views 7.x-3.11

Also see the Views project page.

Reported by

Fixed by

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Smart Trim- Less Critical – Cross Site Scripting (XSS) – SA-CONTRIB-2015-102

Description

This module implements a new field formatter for textfields (text, text_long, and text_with_summary, if you want to get technical) that improves upon the “Summary or Trimmed” formatter built into Drupal 7.

The module doesn’t sufficiently filter user input via the field settings form.

This vulnerability is mitigated by the fact that only administrative users who can administer field types can exploit it.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.

Versions affected

  • Smart Trim 7.x-1.x versions prior to 7.x-1.5.

Drupal core is not affected. If you do not use the contributed Smart Trim module,
there is nothing you need to do.

Solution

Install the latest version:

Also see the Smart Trim project page.

Reported by

Fixed by

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

MailChimp – Moderately Critical – Cross Site Scripting (XSS) – SA-CONTRIB-2015-101

Description

The MailChimp module allows you to create and manage mailing lists via MailChimp’s API.

The MailChimp Signup submodule does not properly sanitize some user input, allowing a malicious user to embed scripts within a page, resulting in a Cross-site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with the “administer mailchimp” permission and the “MailChimp Signup” submodule must be enabled.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.

Versions affected

  • MailChimp 7.x-3.x versions prior to 7.x-3.3. (Mailchimp 7.x-2.x versions are not affected)

Drupal core is not affected. If you do not use the contributed MailChimp module,
there is nothing you need to do.

Solution

Install the latest version:

Also see the MailChimp project page.

Reported by

Fixed by

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: 

Camtasia Relay – Moderately Critical – Cross Site Scripting (XSS) – SA-CONTRIB-2015-100

Description

This module enables you to integrate your Drupal site with TechSmith Relay software.
The module doesn’t sufficiently sanitize user input under the meta access tab.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission “view meta information”.

CVE identifier(s) issued

  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.

Versions affected

  • camtasia_relay 6.x-2.x versions prior to 6.x-3.2.
  • camtasia_relay 7.x-2.x versions prior to 7.x-1.3.

Drupal core is not affected. If you do not use the contributed Camtasia Relay module,
there is nothing you need to do.

Solution

Install the latest version:

Also see the Camtasia Relay project page.

Reported by

Fixed by

Coordinated by

Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Follow the Drupal Security Team on Twitter at https://twitter.com/drupalsecurity

Drupal version: