Drupal

Project: Drupal coreDate: 2021-September-15Security risk: Moderately critical 12∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:DefaultVulnerability: Access BypassCVE IDs: CVE-2020-13677Description: 

Under some circumstances, the Drupal core JSON:API module does not properly restrict access to certain content, which may result in unintended access bypass.

Sites that do not have the JSON:API module enabled are not affected.

This advisory is not covered by Drupal Steward.

Solution: 

Install the latest version:

• If you are using Drupal 9.2, update to Drupal 9.2.6.
• If you are using Drupal 9.1, update to Drupal 9.1.13.
• If you are using Drupal 8.9, update to Drupal 8.9.19.

Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage.

Drupal 7 core does not include the JSON:API module and therefore is not affected.

Reported By: 

• Brad Jones

Fixed By: 

• Brad Jones
• Jess of the Drupal Security Team
• Björn Brala
• Gabe Sullice
• Mateu Aguiló Bosch

Project: Drupal coreDate: 2021-September-15Security risk: Moderately critical 10∕25 AC:Basic/A:User/CI:Some/II:None/E:Theoretical/TD:DefaultVulnerability: Access bypassCVE IDs: CVE-2020-13676Description: 

The QuickEdit module does not properly check access to fields in some circumstances, which can lead to unintended disclosure of field data.

Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed.

This advisory is not covered by Drupal Steward.

Solution: 

Install the latest version:

• If you are using Drupal 9.2, update to Drupal 9.2.6.
• If you are using Drupal 9.1, update to Drupal 9.1.13.
• If you are using Drupal 8.9, update to Drupal 8.9.19.

Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage.

Drupal 7 core does not include the QuickEdit module and therefore is not affected.

Uninstalling the QuickEdit module will also mitigate the vulnerability. Site owners may wish to consider this option as the QuickEdit module will be removed from core in Drupal 10.

Reported By: 

• Greg Watson

Fixed By: 

• Greg Watson
• Wim Leers
• Jess of the Drupal Security Team
• Alex Bronstein of the Drupal Security Team
• Lee Rowlands of the Drupal Security Team
• Joseph Zhao
• Vijay Mani
• Adam G-H
• Drew Webber of the Drupal Security Team

Project: Drupal coreDate: 2021-September-15Security risk: Moderately critical 11∕25 AC:Basic/A:None/CI:None/II:Some/E:Theoretical/TD:UncommonVulnerability: Access bypassCVE IDs: CVE-2020-13675Description: 

Drupal's JSON:API and REST/File modules allow file uploads through their HTTP APIs. The modules do not correctly run all file validation, which causes an access bypass vulnerability. An attacker might be able to upload files that bypass the file validation process implemented by modules on the site.

This vulnerability is mitigated by three factors:

1. The JSON:API or REST File upload modules must be enabled on the site.
2. An attacker must have access to a file upload via JSON:API or REST.
3. The site must employ a file validation module.

This advisory is not covered by Drupal Steward.

Also see GraphQL - Moderately critical - Access bypass - SA-CONTRIB-2021-029 which addresses a similar vulnerability for that module.

Solution: 

Install the latest version:

• If you are using Drupal 9.2, update to Drupal 9.2.6.
• If you are using Drupal 9.1, update to Drupal 9.1.13.
• If you are using Drupal 8.9, update to Drupal 8.9.19.

Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage.

Drupal 7 core is not affected.

Reported By: 

• Klaus Purer

Fixed By: 

• Klaus Purer
• Lee Rowlands of the Drupal Security Team
• Alex Pott of the Drupal Security Team
• Jess of the Drupal Security Team
• Samuel Mortenson
• Drew Webber of the Drupal Security Team
• Kim Pepper

Project: Drupal coreDate: 2021-September-15Security risk: Moderately critical 14∕25 AC:Complex/A:None/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross Site Request ForgeryCVE IDs: CVE-2020-13674Description: 

The QuickEdit module does not properly validate access to routes, which could allow cross-site request forgery under some circumstances and lead to possible data integrity issues.

Sites are only affected if the QuickEdit module (which comes with the Standard profile) is installed. Removing the "access in-place editing" permission from untrusted users will not fully mitigate the vulnerability.

This advisory is not covered by Drupal Steward.

Solution: 

Install the latest version:

• If you are using Drupal 9.2, update to Drupal 9.2.6.
• If you are using Drupal 9.1, update to Drupal 9.1.13.
• If you are using Drupal 8.9, update to Drupal 8.9.19.

Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage.

Drupal 7 core does not include the QuickEdit module and therefore is not affected.

Uninstalling the QuickEdit module will also mitigate the vulnerability. Site owners may wish to consider this option as the QuickEdit module will be removed from core in Drupal 10.

Reported By: 

• Samuel Mortenson

Fixed By: 

• Wim Leers
• Greg Knaddison of the Drupal Security Team
• Jess of the Drupal Security Team
• Lee Rowlands of the Drupal Security Team
• Vijay Mani
• Heine of the Drupal Security Team
• Alex Bronstein of the Drupal Security Team
• Adam G-H
• Drew Webber of the Drupal Security Team
• Théodore Biadala

Project: Drupal coreDate: 2021-September-15Security risk: Moderately critical 10∕25 AC:Basic/A:User/CI:None/II:Some/E:Theoretical/TD:DefaultVulnerability: Cross Site Request ForgeryCVE IDs: CVE-2020-13673Description: 

The Drupal core Media module allows embedding internal and external media in content fields. In certain circumstances, the filter could allow an unprivileged user to inject HTML into a page when it is accessed by a trusted user with permission to embed media. In some cases, this could lead to cross-site scripting.

This advisory is not covered by Drupal Steward.

Also see Entity Embed - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2021-028 which addresses a similar vulnerability for that module.

Updated 18:15 UTC to clarify text.

Solution: 

Install the latest version:

• If you are using Drupal 9.2, update to Drupal 9.2.6.
• If you are using Drupal 9.1, update to Drupal 9.1.13.
• If you are using Drupal 8.9, update to Drupal 8.9.19.

Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage.

Drupal 7 core is not affected.

Reported By: 

• Aaron Zinck

Fixed By: 

• Aaron Zinck
• Sean Blommaert
• Alex Bronstein of the Drupal Security Team
• Marcos Cano
• Lee Rowlands of the Drupal Security Team
• Adam G-H
• Jess of the Drupal Security Team
• Drew Webber of the Drupal Security Team
• Neil Drumm of the Drupal Security Team
• Brian Tofte-Schumacher

Project: Drupal coreDate: 2021-August-12Security risk: Moderately critical 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:DefaultVulnerability: Third-party librariesDescription: 

The Drupal project uses the CKEditor, library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal.

Vulnerabilities are possible if Drupal is configured to allow use of the CKEditor library for WYSIWYG editing. An attacker that can create or edit content (even without access to CKEditor themselves) may be able to exploit one or more Cross-Site Scripting (XSS) vulnerabilities to target users with access to the WYSIWYG CKEditor, including site admins with privileged access.

For more information, see CKEditor's announcement of the release.

This advisory is not covered by Drupal Steward.

Solution: 

Install the latest version:

• If you are using Drupal 9.2, update to Drupal 9.2.4.
• If you are using Drupal 9.1, update to Drupal 9.1.12.
• If you are using Drupal 8.9, update to Drupal 8.9.18.

Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage.

Drupal 7 core is not affected, although Drupal 7, 8, and 9 site owners should review their site following the protocol for managing external libraries and plugins previously suggested by the Drupal Security Team, as contributed projects may use additional CKEditor plugins not packaged in Drupal core.

Reported By: 

• Krzysztof Krzton

Fixed By: 

• xjm of the Drupal Security Team
• Jen Lampton
• Wim Leers
• Chris McCafferty of the Drupal Security Team
• James Gilliland of the Drupal Security Team

Project: Drupal coreDate: 2021-July-21Security risk: Critical 15∕25 AC:Complex/A:User/CI:All/II:All/E:Theoretical/TD:UncommonVulnerability: Drupal core - Critical - Third-party librariesCVE IDs: CVE-2021-32610Description: 

The Drupal project uses the pear Archive_Tar library, which has released a security update that impacts Drupal.

The vulnerability is mitigated by the fact that Drupal core's use of the Archive_Tar library is not vulnerable, as it does not permit symlinks.

Exploitation may be possible if contrib or custom code uses the library to extract tar archives (for example .tar, .tar.gz, .bz2, or .tlz) which come from a potentially untrusted source.

This advisory is not covered by Drupal Steward.

Solution: 

Install the latest version:

• If you are using Drupal 9.2, update to Drupal 9.2.2.
• If you are using Drupal 9.1, update to Drupal 9.1.11.
• If you are using Drupal 8.9, update to Drupal 8.9.17.
• If you are using Drupal 7, update to Drupal 7.82.

Versions of Drupal 8 prior to 8.9.x and versions of Drupal 9 prior to 9.1.x are end-of-life and do not receive security coverage.

Reported By: 

• Drew Webber of the Drupal Security Team

Fixed By: 

• Drew Webber of the Drupal Security Team
• michieltcs
• Heine of the Drupal Security Team
• Jess of the Drupal Security Team
• Lee Rowlands of the Drupal Security Team