Drupal contrib security advisories

Project: RESTfulVersion: 7.x-2.x-dev7.x-1.x-devDate: 2019-March-20Security risk: Critical 18∕25 AC:Complex/A:User/CI:All/II:All/E:Exploit/TD:UncommonVulnerability: Remote code executionDescription: 

This resolves issues described in SA-CORE-2019-003 for this module.

Solution: 

• If you use the RESTful module for Drupal 7.x, upgrade to RESTful 7.x-1.10 or RESTful 7.x-2.17

Project: Back To TopVersion: 7.x-1.x-devDate: 2019-March-20Security risk: Moderately critical 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site ScriptingDescription: 

This module enables you to add a button that hovers in the bottom of your screen and allows users to smoothly scroll up the page using jQuery.

The module doesn't sufficiently sanitize the code that gets printed on pages leading to a Cross Site Scripting (XSS) issue.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "access backtotop settings".

Solution: 

Install the latest version:

• If you use the Back To Top module for Drupal 7.x, upgrade to Back To Top 7.x-1.6

Reported By: 

• Balazs Janos Tatar

Fixed By: 

• Mattias Axelsson
• Balazs Janos Tatar

Coordinated By: 

• Balazs Janos Tatar

Project: AddToAny Share ButtonsVersion: 7.x-4.x-devDate: 2019-March-20Security risk: Moderately critical 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross Site ScriptingDescription: 

This module enables you to add social media share buttons on your website to its content and pages.

The module doesn't sufficiently mark its administration permission restricted, allowing cross site scripting vulnerabilities to users who have access to its admin settings.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "administer addtoany".

Solution: 

• If you use the AddToAny Share Buttons module for Drupal 7.x, upgrade to AddToAny Share Buttons 7.x-4.16

Reported By: 

• Balazs Janos Tatar

Fixed By: 

• Balazs Janos Tatar
• micropat

Coordinated By: 

• Balazs Janos Tatar

Project: Simple hierarchical selectDate: 2019-March-13Security risk: Moderately critical 10∕25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross site request forgeryDescription: 

Simple hierarchical select defines a new form widget for taxonomy fields to select a term by "browsing" through the vocabularies hierarchy. It also allows users to create new taxonomy terms using its widget directly in the node form.

Version 7.x of Simple hierarchical select doesn't sufficiently checks permission when creating new terms so attackers can create arbitrary taxonomy terms in any vocabularies the victim has access to..
This vulnerability is mitigated by the fact that an attacker must trick a user with permission to create terms to visit a specially prepared web page controlled by the attacker.

Solution: 

Install the latest version:

• If you use Simple hierarchical select prior to 7.x-1.7 update to 7.x-1.8
• If you are unable to update, simply deactivate the option to allow creating new terms in the widget settings.

Note that the Drupal 8 version of this module is unaffected.

Reported By: 

• Ayesh Karunaratne

Fixed By: 

• Ayesh Karunaratne
• Stefan Borchert
• Greg Knaddison of the Drupal Security Team

Coordinated By: 

Greg Knaddison of the Drupal Security Team

Project: VideoDate: 2019-March-13Security risk: Critical 19∕25 AC:None/A:Admin/CI:All/II:All/E:Theoretical/TD:AllVulnerability: Remote Code ExecutionDescription: 

This module provides a field where editors can add videos to their content and this module offers functionality to transcode these videos to different sizes and formats.

The module doesn't sufficiently sanitize some user input on administrative forms.

Solution: 

• If you use the Video module for Drupal 7.x, upgrade to Video 7.x-2.14

Also see the Video project page

Note that the Drupal 8 version of this module is unaffected.

Reported By: 

• Samuel Mortenson of the Drupal Security Team

Fixed By: 

• Michael Hess of the Drupal Security Team
• Jorrit Schippers
• Samuel Mortenson of the Drupal Security Team
• Greg Knaddison of the Drupal Security Team

Coordinated By: 

• Michael Hess of the Drupal Security Team

Project: ViewsVersion: 7.x-3.x-devDate: 2019-March-13Security risk: Less critical 7∕25 AC:Complex/A:None/CI:None/II:None/E:Theoretical/TD:UncommonVulnerability: Cross site scriptingDescription: 

This module enables you to create customized lists of data.

The module doesn't sufficiently sanitize certain field types, leading to a Cross Site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that a view must display a field with the format "Full data (serialized)" and an attacker must have the ability to store malicious markup in that field.

Solution: 

Install the latest version:

• If you use the Views module for Drupal 7.x, upgrade to Views 7.x-3.21

Also see the Views project page.

Reported By: 

• Ralf Stamm

Fixed By: 

• Ralf Stamm
• Damian Lee
• Daniel Wehner
• David Snopek of the Drupal Security Team
• Nate Lampton

Coordinated By: 

• Michael Hess of the Drupal Security Team.

Additional information

Note: Drupal issues individual security advisories for separate vulnerabilities included in a release, rather than lumping "multiple vulnerabilities" into a single advisory. All advisories released today for Views:

• SA-CONTRIB-2019-034
• SA-CONTRIB-2019-035
• SA-CONTRIB-2019-036

Project: ViewsVersion: 7.x-3.x-devDate: 2019-March-13Security risk: Moderately critical 10∕25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Information disclosureDescription: 

This module enables you to create customized lists of data.

The module doesn't sufficiently build queries when used with exposed filters, leading to a possible information disclosure vulnerability in certain rare circumstances.

This vulnerability is mitigated by the fact that a view must have an exposed filter on a field that is used on multiple entity types, both of which are included in the view.

Solution: 

Install the latest version:

• If you use the Views module for Drupal 7.x, upgrade to Views 7.x-3.21

Also see the Views project page.

Reported By: 

• Lucas Hedding

Fixed By: 

• Klaus Purer
• Lucas Hedding
• Greg Knaddison of the Drupal Security Team
• Aaron Zinck
• Daniel Wehner
• Damien McKenna of the Drupal Security Team
• Vijaya Chandran Mani

Coordinated By: 

• Damien McKenna of the Drupal Security Team.

Additional information

Note: Drupal issues individual security advisories for separate vulnerabilities included in a release, rather than lumping "multiple vulnerabilities" into a single advisory. All advisories released today for Views:

• SA-CONTRIB-2019-034
• SA-CONTRIB-2019-035
• SA-CONTRIB-2019-036

Project: ViewsVersion: 7.x-3.x-devDate: 2019-March-13Security risk: Moderately critical 10∕25 AC:Complex/A:None/CI:Some/II:None/E:Theoretical/TD:UncommonVulnerability: Information DisclosureDescription: 

This module enables you to create customized lists of data.

The module doesn't sufficiently protect against argument definitions failing.

This vulnerability is mitigated by the fact that a view must have custom PHP code used as a field validator.

Solution: 

Install the latest version:

• If you use the Views module for Drupal 7.x, upgrade to Views 7.x-3.21

Also see the Views project page.

Reported By: 

• Fabien Leroux

Fixed By: 

• Fabien Leroux
• Daniel Wehner
• Damien McKenna of the Drupal Security Team
• Len Swaneveld

Coordinated By: 

• Michael Hess of the Drupal Security Team.

Additional information

Note: Drupal issues individual security advisories for separate vulnerabilities included in a release, rather than lumping "multiple vulnerabilities" into a single advisory. All advisories released today for Views:

• SA-CONTRIB-2019-034
• SA-CONTRIB-2019-035
• SA-CONTRIB-2019-036

Project: EU Cookie ComplianceVersion: 7.x-1.x-dev8.x-1.x-devDate: 2019-March-06Security risk: Critical 15∕25 AC:None/A:Admin/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross site scriptingDescription: 

This module addresses the General Data Protection Regulation (GDPR) that came into effect 25th May 2018, and the EU Directive on Privacy and Electronic Communications from 2012. It provides a banner where you can gather consent from the user when the website stores cookies on their computer or otherwise handles their personal information.

The module doesn't sufficiently sanitize data for some interface labels and strings shown in the cookie policy banner, opening up possibility of Cross Site Scripting exploits that can be created by somebody that has access to the admin interface of the module.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer EU Cookie Compliance banner". For Drupal 8, the vulnerability also requires access to a text format that doesn't sanitize data.

Solution: 

Install the latest version:

• If you use EU Cookie Compliance module for Drupal 7.x, upgrade to EU Cookie Compliance 7.x-1.26
• If you use EU Cookie Compliance module for Drupal 8.x, upgrade to EU Cookie Compliance 8.x-1.3

Also see the EU Cookie Compliance project page.

Reported By: 

• Yonatan Offek

Fixed By: 

• Luigi Guevara
• Sven Berg Ryen

Coordinated By: 

• Greg Knaddison of the Drupal Security Team
• Michael Hess of the Drupal Security Team

Project: UbercartDate: 2019-March-06Security risk: Moderately critical 12∕25 AC:None/A:Admin/CI:None/II:Some/E:Proof/TD:DefaultVulnerability: Cross Site Request ForgeryDescription: 

The Ubercart module provides a shopping cart and e-commerce features for Drupal.

The taxes module doesn't sufficiently protect the tax rate cloning feature. A malicious user could trick a store administrator into duplicating an existing tax rate by getting them to visit a specially-crafted URL.

Solution: 

Install the latest version:

• If you use the Ubercart module for Drupal 7.x, upgrade to Ubercart 7.x-3.12

Reported By: 

• Ayesh Karunaratne

Fixed By: 

• Dave Long
• Ayesh Karunaratne
• Tim Rohaly

Coordinated By: 

• Michael Hess of the Drupal Security Team

Project: Drupal voor GemeentenDate: 2019-March-06Security risk: Moderately critical 13∕25 AC:None/A:None/CI:None/II:Some/E:Theoretical/TD:UncommonVulnerability: Access BypassDescription: 

The DvG distrubition contains the feature module dvg_domains to support multiple domains.

When the dvg_domains feature module is enabled, anonymous users are able to access some administration pages and change the settings exposed on those pages.

This issue can be mitigated by disabling the dvg_domains module.

Solution: 

Install the latest version:

• If you use the module dvg_domains from the DvG distribution upgrade to DvG 7.x-1.9

Reported By: 

• Bernard Skibinski

Fixed By: 

• paulvandenburg

Coordinated By: 

• Greg Knaddison of the Drupal Security Team

Project: FacetsVersion: 8.x-1.x-devDate: 2019-February-27Security risk: Moderately critical 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross site scriptingDescription: 

This module enables you to create facet-filters for results of a search query and exposes them as blocks

The module doesn't sufficiently escape HTML under the scenario leading to a Cross Site Scripting (XSS) vulnerability.

This vulnerability is mitigated by two factors. First, an attacker must have a way to insert results in the dataset that is exposed as a facet before this can happen. The permission to inject malicious strings depends on the site's search configuration but could be available to any user who can create content in a site. Second, the site must be using the Javascript-based dropdown widget.

Solution: 

• Install the latest version Facets 8.x-1.3

An effective mitigation is to change the widget to use links instead of the dropdown widget.

Reported By: 

• Ide Braakman

Fixed By: 

• Jimmy Henderickx
• Joris Vercammen

Coordinated By: 

• Greg Knaddison of the Drupal Security Team

Project: Rabbit HoleVersion: 7.x-2.x-devDate: 2019-February-27Security risk: Moderately critical 14∕25 AC:None/A:None/CI:Some/II:None/E:Theoretical/TD:DefaultVulnerability: Access bypassDescription: 

The Rabbit Hole module allows administrators to control what should happen when a regular user tries to view an entity at its own page; for example, it may deliver a 403 Access Denied or 404 Page Not Found response, or redirect the user to another path.

The module doesn't respect the Rabbit Hole settings when an entity is being requested with a certain header. This could lead to certain data being exposed even if it shouldn't be. The vulnerability is mitigated by the fact that the user also needs permission to view the content being requested.

Solution: 

Install version 7.x-2.25, available at https://www.drupal.org/project/rabbit_hole/releases/7.x-2.25.

Reported By: 

• Fabian Iwand

Fixed By: 

• Fabian Iwand
• M Parker
• Olof Bokedal

Coordinated By: 

• Greg Knaddison of the Drupal Security Team

Project: ContextVersion: 7.x-3.x-devDate: 2019-February-27Security risk: Moderately critical 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross site scriptingDescription: 

This module enables you to manage contextual conditions and reactions for different portions of your site.

The module doesn't sufficiently sanitize user output when displayed leading to a Cross Site Scripting (XSS) vulnerability.

This vulnerability is mitigated by the fact that an attacker must have the ability to store malicious markup in the site (e.g. permission to create a node with a field that accepts "filtered html").

Solution: 

Install the latest version:

• If you use the context module for Drupal 7.x, upgrade to context 7.x-3.10

Also see the Context project page.

Reported By: 

• poiu

Fixed By: 

• Bostjan Kovac

Coordinated By: 

• Ivo Van Geertruyen of the Drupal Security Team
• Greg Knaddison of the Drupal Security Team
• Cash Williams of the Drupal Security Team

Project: Path BreadcrumbsVersion: 7.x-3.x-devDate: 2019-February-27Security risk: Moderately critical 13∕25 AC:Basic/A:Admin/CI:Some/II:Some/E:Theoretical/TD:AllVulnerability: Cross site scriptingDescription: 

This module enables you to configure breadcrumbs for any Drupal page.

This module doesn't properly sanitize custom breadcrumb configuration in all cases, leading to an XSS vulnerability.

This vulnerability is mitigated by the fact that an attacker must have a role with the permission "Administer Path Breadcrumbs".

Solution: 

Install the latest version:

• Upgrade to Path Breadcrumbs 7.x-3.4

Also see the Path Breadcrumbs project page.

Reported By: 

• poiu

Fixed By: 

• Kate Marshalkina

Coordinated By: 

• Greg Knaddison of the Drupal Security Team

Project: ServicesVersion: 7.x-3.x-devDate: 2019-February-27Security risk: Critical 19∕25 AC:None/A:None/CI:All/II:Some/E:Theoretical/TD:DefaultVulnerability: SQL InjectionDescription: 

This module provides a standardized solution for building API's so that external clients can communicate with Drupal.

The module doesn't sufficiently sanitize user input for entity index resources thus allowing SQL Injection attacks.

This vulnerability is mitigated by the fact that the Drupal 7 site must have an "index" resource(s) enabled under the Services endpoint configuration (admin/structure/services/list/MY-ENDPOINT/resources) and an attacker must know the endpoint's machine name.

Install the 7.x-3.22 version of the Services module for the fix, or simply disable any "index" resources to stop the attack vector.

Solution: 

Install the latest version:

• If you use the 7.x-3.x Services module for Drupal, upgrade to Services 7.x-3.22

Reported By: 

• Samuel Mortenson of the Drupal Security Team

Fixed By: 

• Tyler Frankenstein
• Samuel Mortenson of the Drupal Security Team
• Ivo Van Geertruyen of the Drupal Security Team

Coordinated By: 

• Samuel Mortenson of the Drupal Security Team

Project: Font Awesome IconsDate: 2019-February-20Security risk: Critical 18∕25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:UncommonVulnerability: Remote Code ExecutionDescription: 

This resolves issues described in SA-CORE-2019-003 for this module. Not all configurations are affected. See SA-CORE-2019-003 for details.

Solution: 

• If you use the Font Awesome Icons module for Drupal 8.x, upgrade to Font Awesome Icons 8.x-2.12.

Project: Translation Management ToolDate: 2019-February-20Security risk: Critical 16∕25 AC:Basic/A:User/CI:All/II:All/E:Theoretical/TD:UncommonVulnerability: Remote Code ExecutionDescription: 

This resolves issues described in SA-CORE-2019-003 for this module. Not all configurations are affected. See SA-CORE-2019-003 for details.

Solution: 

• If you use the TMGMT module for Drupal 8.x, upgrade to TMGMT 8.x-1.7.

Project: ParagraphsDate: 2019-February-20Security risk: Critical 18∕25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:UncommonVulnerability: Remote Code ExecutionDescription: 

This resolves issues described in SA-CORE-2019-003 for this module. Not all configurations are affected. See SA-CORE-2019-003 for details.

Solution: 

• If you use the Paragraphs module for Drupal 8.x, upgrade to Paragraphs 8.x-1.6.

Project: VideoDate: 2019-February-20Security risk: Critical 18∕25 AC:None/A:User/CI:All/II:All/E:Theoretical/TD:UncommonVulnerability: Remote Code ExecutionDescription: 

This resolves issues described in SA-CORE-2019-003 for this module. Not all configurations are affected. See SA-CORE-2019-003 for details.

Solution: 

Install the latest version:

• If you use the Video module for Drupal 8, upgrade to Video 8.x-1.4