Skip directly to content

Feed aggregator

SA-CONTRIB-2014-106 - Commerce Authorize.Net SIM/DPM Payment Methods - Access Bypass

Drupal Contrib Security Announcements - Wed, 10/29/2014 - 19:55
Description

This module provides payment methods for the Drupal Commerce package to permit the use of the Authorize.Net payment gateway's SIM and DPM payment protocols.

Access Bypass

The module doesn't sufficiently protect the Drupal Commerce order number passed to the Authorize.Net payment gateway, allowing a specially modified payment POST transaction to Authorize.Net to be applied to a previous order still in the checkout state. This could allow the previous transaction to be marked as paid despite the fact that the payment applied was smaller than its outstanding balance.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.
Versions affected
  • Commerce Authorize.Net SIM/DPM Payment Methods 7.x-1.x versions prior to 7.x-1.1.

Drupal core is not affected. If you do not use the contributed Commerce Authorize.Net SIM/DPM Payment Methods module,
there is nothing you need to do.

Solution

Install the latest version:

Also see the Commerce Authorize.Net SIM/DPM Payment Methods project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at
https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies,
writing secure code for Drupal, and
securing your site.

Drupal version: Drupal 7.x
Categories: Security posts

SA-CONTRIB-2014-105 - OG Menu - Access Bypass

Drupal Contrib Security Announcements - Wed, 10/29/2014 - 16:50
Description

OG Menu allows using menus within Organic Groups.

The permissions for accessing the module settings were to broad, possibly granting access to users who would normally not be able to change the OG Menu configuration.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access administration pages".

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.
Versions affected
  • OG Menu 7.x-2.x versions prior to 7.x-2.2.

Drupal core is not affected. If you do not use the contributed OG Menu module,
there is nothing you need to do.

Solution

Install the latest version of the 7.x-2.x branch:

The OG Menu 7.x-3.x branch is not affected.

Also see the OG Menu project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Drupal version: Drupal 7.x
Categories: Security posts

SA-CONTRIB-2014-104 - Addressfield Tokens - Cross Site Scripting

Drupal Contrib Security Announcements - Wed, 10/29/2014 - 16:37
Description

The Addressfield Tokens module extends the Addressfield module by adding full token support.

The module doesn't sufficiently filter malicious user input, opening a Cross Site Scripting (XSS) vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission "create content" or "edit content".

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.
Versions affected
  • Addressfield Tokens 7.x-1.x versions prior to 7.x-1.5.

Drupal core is not affected. If you do not use the contributed Addressfield Tokens module,
there is nothing you need to do.

Solution

Install the latest version:

Also see the Addressfield Tokens project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at
https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Drupal version: Drupal 7.x
Categories: Security posts

SA-CONTRIB-2014-103 - Passwordless - Cross Site Scripting (XSS)

Drupal Contrib Security Announcements - Wed, 10/29/2014 - 16:03
Description

This module replaces the regular Drupal login form with a modification of the password-request form, to give the possibility to log in without using a password.

The module doesn't sufficiently sanitize user-generated text entered in the module's configuration form.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "configure passwordless settings".

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.
Versions affected
  • Passwordless 7.x-1.x versions up to 7.x-1.8.

Drupal core is not affected. If you do not use the contributed Passwordless module,
there is nothing you need to do.

Solution

Install the latest version:

Also see the Passwordless project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Drupal version: Drupal 7.x
Categories: Security posts

SA-CONTRIB-2014-102 - Document - Cross Site Scripting

Drupal Contrib Security Announcements - Wed, 10/22/2014 - 15:15
Description

Document module is a basic Document Management System for Drupal.

Cross Site Scripting (XSS)

The module wasn't sanitizing user input sufficiently in a few use cases.

This vulnerability is mitigated by the the fact that a user must have permissions to add or edit documents to be able to exploit the vulnerability.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.
Versions affected
  • Document 6.x-1.11 versions prior to 6.x-1.11.
  • Document 7.x-1.20 versions prior to 7.x-1.20.

Drupal core is not affected. If you do not use the contributed Document module,
there is nothing you need to do.

Solution

Install the latest version:

Also see the Document project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at
https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies,
writing secure code for Drupal, and
securing your site.

Drupal version: Drupal 6.xDrupal 7.x
Categories: Security posts

SA-CONTRIB-2014-101 - Ubercart - Cross Site Request Forgery

Drupal Contrib Security Announcements - Wed, 10/22/2014 - 15:13
Description

The Ubercart module provides a shopping cart and e-commerce features for Drupal.

Cross Site Request Forgery (CSRF)

The country administration links are not properly protected. A malicious user could trick a store administrator into enabling or disabling a country by getting them to visit a specially-crafted URL.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.
Versions affected
  • Ubercart 7.x-3.x versions prior to 7.x-3.8.
  • Ubercart 6.x-2.x versions prior to 6.x-2.14.

Drupal core is not affected. If you do not use the contributed Ubercart module,
there is nothing you need to do.

Solution

Install the latest version:

Also see the Ubercart project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at
https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies,
writing secure code for Drupal, and
securing your site.

Drupal version: Drupal 6.xDrupal 7.x
Categories: Security posts

SA-CONTRIB-2014-100 - Bad Behavior - Information Disclosure

Drupal Contrib Security Announcements - Wed, 10/22/2014 - 15:11
Description

This module enables you to to target any malicious software directed at a Web site, whether it be a spambot, ill-designed search engine bot, or system crackers. It blocks such access and then logs their attempts.

Information Disclosure

The module doesn't sufficiently sanitize log data, allowing usernames and passwords to get included in its logs.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer bad behavior".

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.
Versions affected
  • badbehavior 6.x-2.x versions prior to 6.x-2.2216.
  • badbehavior 7.x-2.x versions prior to 7.x-2.2216.

Drupal core is not affected. If you do not use the contributed Bad Behavior module,
there is nothing you need to do.

Solution

Install the latest version:

Also see the Bad Behavior project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at
https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies,
writing secure code for Drupal, and
securing your site.

Drupal version: Drupal 6.xDrupal 7.x
Categories: Security posts

SA-CONTRIB-2014-099 - Open Atrium Core - Access bypass

Drupal Contrib Security Announcements - Wed, 10/15/2014 - 16:56
Description

The oa_core module contains the base access control mechanism for the Open Atrium distribution (OA2). In OA2, file attachments are given the same access permission as the node they are attached to.

The vulnerability is when an attachment is removed from a node that has Revisions enabled. It allows anonymous users to view the file that is still attached to the previous revision.

This vulnerability is mitigated by the fact that it requires using Revisions and removing files attached to revisions. If revisions are disabled or files are not removed from nodes then access works as designed.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.
Versions affected
  • oa_core 7.x-2.x versions prior to 7.x-2.22.

Drupal core is not affected. If you do not use the contributed Open Atrium module,
there is nothing you need to do.

Solution

Install the latest version:

Also see the Open Atrium project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at
https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies,
writing secure code for Drupal, and
securing your site.

Drupal version: Drupal 7.x
Categories: Security posts

SA-CORE-2014-005 - Drupal core - SQL injection

Drupal Core Security Announcements - Wed, 10/15/2014 - 16:02
Description

Drupal 7 includes a database abstraction API to ensure that queries executed against the database are sanitized to prevent SQL injection attacks.

A vulnerability in this API allows an attacker to send specially crafted requests resulting in arbitrary SQL execution. Depending on the content of the requests this can lead to privilege escalation, arbitrary PHP execution, or other attacks.

This vulnerability can be exploited by anonymous users.

CVE identifier(s) issued

  • CVE-2014-3704
Versions affected
  • Drupal core 7.x versions prior to 7.32.
Solution

Install the latest version:

If you are unable to update to Drupal 7.32 you can apply this patch to Drupal's database.inc file to fix the vulnerability until such time as you are able to completely upgrade to Drupal 7.32.

Also see the Drupal core project page.

Reported by
  • Stefan Horst
Fixed by Coordinated by Contact and More Information

We've prepared a FAQ on this release. Read more at https://www.drupal.org/node/2357241.

The Drupal security team can be reached at security at drupal.org or via the contact form at
https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Drupal version: Drupal 7.x
Categories: Security posts

SA-CONTRIB-2014-098 - CKEditor - Cross Site Scripting (XSS)

Drupal Contrib Security Announcements - Wed, 10/15/2014 - 12:36
Description

The CKEditor module (and its predecessor, FCKeditor module) allows Drupal to replace textarea fields with CKEditor 3.x/4.x (FCKeditor 2.x in case of FCKeditor module) - a visual HTML editor, sometimes called WYSIWYG editor.

Both modules define a function, called via an ajax request, that filters text before passing it into the editor, to prevent certain cross site scripting attacks on content edits (that the JavaScript library might not handle). Because the function did not check a CSRF token for anonymous users, it was possible to perform reflected XSS against anonymous users via CSRF.

The problem existed in CKEditor/FCKeditor modules for Drupal, not in JavaScript libraries with the same names.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.
Versions affected
  • CKEditor 7.x-1.x versions prior to 7.x-1.15.
  • CKEditor 6.x-1.x versions prior to 6.x-1.14.
  • FCKeditor 6.x-2.x versions prior to 6.x-2.3.

Drupal core is not affected. If you do not use the contributed CKEditor - WYSIWYG HTML editor module, there is nothing you need to do.

Solution

Install the latest version:

Also see the CKEditor - WYSIWYG HTML editor project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at
https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Drupal version: Drupal 6.xDrupal 7.x
Categories: Security posts

SA-CONTRIB-2014-097 - nodeaccess - Access Bypass

Drupal Contrib Security Announcements - Wed, 10/08/2014 - 13:40
Description

Nodeaccess is a Drupal access control module which provides view, edit and delete access to nodes.

This module enables you to inadvertently allow an author of a node view/edit/delete the node in question (who may not have access). The module over-eagerly grants read/write/delete access to all authors of nodes.

In addition, a node that is unpublished, but is granted node specific permissions will obey the node specific permissions and not the unpublished content permission for the role.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.
Versions affected
  • Nodeaccess 6.x-1.x versions prior to 6.x-1.5.
  • Nodeaccess 7.x-1.x versions prior to 7.x-1.4.

Drupal core is not affected. If you do not use the contributed Nodeaccess module,
there is nothing you need to do.

Solution

Ensure that you are using the latest version of the Nodeaccess module when installing. For existing nodes, please ensure that the author permissions are correct.

Also see the Nodeaccess project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at
https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies,
writing secure code for Drupal, and
securing your site.

Drupal version: Drupal 6.xDrupal 7.x
Categories: Security posts

SA-CONTRIB-2014-096 - OAuth2 Client - Cross Site Scripting (XSS)

Drupal Contrib Security Announcements - Wed, 10/08/2014 - 13:33
Description

OAuth2 Client is an API support module, enabling other modules to connect to services using OAuth2 authentication.

Within its API code the Client class exposes variables in an error message, which originate from a third party source without proper sanitisation thus leading to a Cross Site Scripting vulnerability.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.
Versions affected
  • OAuth2 Client 7.x-2.x versions prior to 7.x-1.2.

Drupal core is not affected. If you do not use the contributed OAuth2 Client module,
there is nothing you need to do.

Solution

Install the latest version:

Also see the OAuth2 Client project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at
https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies,
writing secure code for Drupal, and
securing your site.

Drupal version: Drupal 7.x
Categories: Security posts

SA-CONTRIB-2014-095 - Safeword - Cross Site Scripting (XSS)

Drupal Contrib Security Announcements - Wed, 09/24/2014 - 19:30
Description

The safeword module provides an automatically generated 'Machine Name' when text is entered into a human-readable field.

The module doesn't sufficiently sanitize the field description that can be used as help text under the machine name editing field.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer taxonomy".

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.
Versions affected
  • Safeword 7.x-1.x versions prior to 7.x-1.9.

Drupal core is not affected. If you do not use the contributed Safeword module,
there is nothing you need to do.

Solution

Install the latest version:

Also see the Safeword project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at
https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies,
writing secure code for Drupal, and
securing your site.

Categories: Security posts

SA-CONTRIB-2014-094 - Webform Patched - Cross Site Scripting (XSS)

Drupal Contrib Security Announcements - Wed, 09/24/2014 - 19:29
Description

The Webform Patched module is a fork of the Webform module with Token support added. The module enables you to create forms which can be used for surveys, contact forms or other data collection throughout your site.

The module doesn't sufficiently sanitize field label titles when two fields have the same form_key, which can only be managed by carefully crafting the webform structure via a specific set of circumstances.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "create webform content".

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.
Versions affected
  • Webform Patched 6.x-3.x versions prior to 6.x-3.20.
  • Webform Patched 7.x-3.x versions prior to 7.x-3.20.

Drupal core is not affected. If you do not use the contributed Webform Patched module,
there is nothing you need to do.

Solution

Install the latest version:

Also see the Webform Patched project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at
https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies,
writing secure code for Drupal, and
securing your site.

Drupal version: Drupal 6.xDrupal 7.x
Categories: Security posts

SA-CONTRIB-2014-093 - Twilio - Information Disclosure

Drupal Contrib Security Announcements - Wed, 09/24/2014 - 19:29
Description

This module enables you to easily add SMS and VOIP functionality to your website by leveraging the Twilio cloud Voip and SMS service.

The module doesn't expose its own permissions for administration including viewing and editing the Twilio authentication tokens. It relies only on "access administration pages" permission which is frequently granted to less-trusted users.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access administration pages".

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.
Versions affected
  • Twilio 7.x-1.x versions prior to 7.x-1.9.

Drupal core is not affected. If you do not use the contributed Twilio module,
there is nothing you need to do.

Solution

Install the latest version:

  • If you use the Twiliio module for Drupal 7.x, upgrade to Twilio 7.x-1.9

Also see the Twilio project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at
https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies,
writing secure code for Drupal, and
securing your site.

Drupal version: Drupal 7.x
Categories: Security posts

SA-CONTRIB-2014-092 - Services - Cross Site Scripting, Access bypass

Drupal Contrib Security Announcements - Wed, 09/24/2014 - 19:21
Description

The Services module enables you to expose an API to third party systems using REST, XML-RPC or other protocols.

New user's password set to weak password in _user_resource_create()

When creating a new user account via Services, the new user's password was set to a weak password.

This issue is mitigated by the fact that the user resource must be enabled (or least have been enabled in the past) and new user registration permitted via Services.

Action required: This release of Services comes with an interface and a drush command to perform actions in order to secure your site and get rid of this vulnerability. After installing this release and running the regular database updates, make sure to read all the information provided at admin/config/services/services-security, and pick the option most suited to your site. For example, you can reset the password of all user accounts that have been created since August 30th, 2013 (recommended).

Unfiltered JSONP callback parameter (XSS)

The JSONP response of a callback parameter is unfiltered and outputs raw HTTP data. This can lead to arbitrary JavaScript execution.

This issue is mitigated by the fact that JSONP is not enabled by default in the REST server response formatters and the HTTP client Accept header must be set to text/javascript or application/javascript if the "xml" formatter is enabled.

Services module now restricts callback parameters to alphanumeric characters only and a hard limit of 60 characters.

Flood control for user login bypass

Flood control was not properly enforced leaving it vulnerable to brute force attacks. Services now implements flood control just like core Drupal does.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.
Versions affected
  • Services 7.x-3.x versions prior to 7.x-3.10.

Drupal core is not affected. If you do not use the contributed Services module,
there is nothing you need to do.

Solution

Install the latest version:

  1. If you use the Services module for Drupal 7.x, upgrade to Services 7.x-3.10
  2. follow the security update instructions at admin/config/services/services-security

Also see the Services project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at
https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies,
writing secure code for Drupal, and
securing your site.

Drupal version: Drupal 7.x
Categories: Security posts

SA-CONTRIB-2014-091 - Survey Builder - Cross Site Scripting (XSS)

Drupal Contrib Security Announcements - Wed, 09/17/2014 - 15:07
Description

This module allows you to use the Form Builder module to provide an intuitive interface for building surveys, along with the back-end for storing surveys and their responses.

Cross Site Scripting (XSS)

When viewing surveys at "/surveys", the survey titles printed out are not sanitized. Any potentially dangerous code in the survey titles is also rendered.

This vulnerability is mitigated by the fact that a user must have the "Create Survey" permission to be able to set the survey titles.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.
Versions affected
  • survey_builder 7.x-1.x versions prior to 7.x-1.2.

Drupal core is not affected. If you do not use the contributed Survey Builder module,
there is nothing you need to do.

Solution

Install the latest version:

Also see the Survey Builder project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at
https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies,
writing secure code for Drupal, and
securing your site.

Drupal version: Drupal 7.x
Categories: Security posts

SA-CONTRIB-2014-090 Speech recognition - Multiple vulnerabilities

Drupal Contrib Security Announcements - Wed, 09/17/2014 - 14:55
Description

This module enables you to add speech recognition to forms, allowing site admins to enable experimental Speech Input API features on form inputs through the user interface.

Cross Site Scripting (XSS)

The module incorrectly prints fields without proper sanitization thereby opening a Cross Site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer speech".

Cross Site Request Forgery (CSRF)

The module enables in-place configuration of form options via AJAX requests, but it doesn't sufficiently check the source of those requests, making possible for an attacker to cause a user to unknowingly make changes to the field configurations.

This vulnerability is mitigated by the fact that the attacked administrator must have a role with the permission "administer speech".

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.
Versions affected
  • All versions of Speech recognition.

Drupal core is not affected. If you do not use the contributed module, there is nothing you need to do.

Drupal core is not affected. If you do not use the contributed Speech recognition module,
there is nothing you need to do.

Solution

If you use the Speech recognition module you should uninstall it.

Also see the Speech recognition project page.

Reported by Fixed by

Not applicable.

Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Drupal version: Drupal 7.x
Categories: Security posts

SA-CONTRIB-2014-089 - Geofield Yandex Maps - Cross Site Scripting (XSS)

Drupal Contrib Security Announcements - Wed, 09/17/2014 - 14:40
Description

The Geofield Yandex Maps module provides a Geofield widget, Geofield formatter, Views handler, Form element and Text filter to allow Yandex maps to be added to a site.

The module does not sufficiently filter user-supplied text, resulting in a persistent Cross Site Scripting (XSS) vulnerability.

The vulnerability is mitigated by the fact that an attacker would need permission to create nodes or entities using the Geofield widget.

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.
Versions affected
  • Geofield Yandex Maps 7.x-1.x versions prior to 7.x-1.2.

Drupal core is not affected. If you do not use the contributed Geofield Yandex Maps module,
there is nothing you need to do.

Solution

Install the latest version:

Also see the Geofield Yandex Maps project page.

Reported by
  • Matt V. (provisional member of the Drupal Security Team)
Fixed by
  • Matt V. (provisional member of the Drupal Security Team)
Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies, writing secure code for Drupal, and securing your site.

Drupal version: Drupal 7.x
Categories: Security posts

SA-CONTRIB-2014-088 - Mollom - Cross-site scripting (XSS)

Drupal Contrib Security Announcements - Wed, 09/17/2014 - 14:11
Description

Mollom is an "intelligent" content moderation web service which determines if a post is potentially spam; not only based on the posted content, but also on the past activity and reputation of the poster across multiple sites.

Mollom offers a feature to report submitted content as inappropriate which allows end users to indicate that a piece of site content is objectionable or out of place. When reporting content, the content title is not sufficiently sanitized to prevent cross-site scripting (XSS) attacks.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission to create content and the content type must be enabled for "Flag as Inappropriate" within the Mollom advanced configuration settings (which is not the default setting).

CVE identifier(s) issued
  • A CVE identifier will be requested, and added upon issuance, in accordance
    with Drupal Security Team processes.
Versions affected
  • Mollom 6.x-2.x versions from 6.x-2.7 to 6.x-2.10
  • Mollom 7.x-2.x versions from 7.x-2.9 to 7.x-2.10

Drupal core is not affected. If you do not use the contributed Mollom module,
there is nothing you need to do.

Solution

Install the latest version:

Also see the Mollom project page.

Reported by Fixed by Coordinated by Contact and More Information

The Drupal security team can be reached at security at drupal.org or via the contact form at href="https://www.drupal.org/contact">https://www.drupal.org/contact.

Learn more about the Drupal Security team and their policies,
writing secure code for Drupal, and
securing your site.

Drupal version: Drupal 6.xDrupal 7.x
Categories: Security posts

Pages