Drupal Releases Security Updates

guest · Sep 17, 2020

Drupal Security Updates (September 16, 2020)

Drupal core - Moderately critical - Information disclosure - SA-CORE-2020-011

Date: 2020-September-16
Security risk: Moderately critical 12∕25 AC:None/A:User/CI:Some/II:None/E:Theoretical/TD:Default
Vulnerability: Information disclosure
Description: A vulnerability exists in the File module which allows an attacker to gain access to the file metadata of a permanent private file that they do not have access to by guessing the ID of the file.
Click to expand...

Drupal core - Moderately critical - Access bypass - SA-CORE-2020-008

Date: 2020-September-16
Security risk: Moderately critical 12∕25 AC:Basic/A:None/CI:Some/II:None/E:Theoretical/TD:Default
Vulnerability: Access bypass
Description: The experimental Workspaces module allows you to create multiple workspaces on your site in which draft content can be edited before being published to the live workspace.
Click to expand...

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2020-010

Date: 2020-September-16
Security risk: Moderately critical 13∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:Default
Vulnerability: Cross-site scripting
Description: Drupal core's built-in CKEditor image caption functionality is vulnerable to XSS.
Click to expand...

Drupal core - Critical - Cross-site scripting - SA-CORE-2020-009

Date: 2020-September-16
Security risk: Critical 15∕25 AC:Basic/A:None/CI:Some/II:Some/E:Theoretical/TD:Default
Vulnerability: Cross-site scripting
Description: Drupal 8 and 9 have a reflected cross-site scripting (XSS) vulnerability under certain circumstances.
An attacker could leverage the way that HTML is rendered for affected forms in order to exploit the vulnerability.
Click to expand...

Drupal core - Moderately critical - Cross-site scripting - SA-CORE-2020-007

Date: 2020-September-16
Security risk: Moderately critical 14∕25 AC:Basic/A:User/CI:Some/II:Some/E:Theoretical/TD:All
Vulnerability: Cross-site scripting
Description: The Drupal AJAX API does not disable JSONP by default, which can lead to cross-site scripting.
Click to expand...

guest · Nov 18, 2020

Drupal Security Updates (November 18, 2020)

Drupal core - Critical - Remote code execution - SA-CORE-2020-012

Date: 2020-November-18
Security risk: Critical 17∕25 AC:Basic/A:User/CI:All/II:All/E:Theoretical/TD:Default
Vulnerability: Remote code execution
CVE IDs: CVE-2020-13671
Description:
Update November 18: Documented longer list of dangerous file extensions

Drupal core does not properly sanitize certain filenames on uploaded files, which can lead to files being interpreted as the incorrect extension and served as the wrong MIME type or executed as PHP for certain hosting configurations.
Click to expand...

guest · Nov 27, 2020

Drupal Security Updates (November 25, 2020)

Drupal core - Critical - Arbitrary PHP code execution - SA-CORE-2020-013

Date: 2020-November-25
Security risk: Critical 18∕25 AC:Complex/A:User/CI:All/II:All/E:Exploit/TD:Uncommon
Vulnerability: Arbitrary PHP code execution
CVE IDs: CVE-2020-28949 CVE-2020-28948
Description:
The Drupal project uses the PEAR Archive_Tar library. The PEAR Archive_Tar library has released a security update that impacts Drupal.
Multiple vulnerabilities are possible if Drupal is configured to allow .tar, .tar.gz, .bz2, or .tlz file uploads and processes them.
Click to expand...

guest · Jan 21, 2021

Drupal Security Updates (January 20, 2021)

Drupal core - Critical - Third-party libraries - SA-CORE-2021-001

Date: 2021-January-20
Security risk: Critical 18∕25 AC:Complex/A:User/CI:All/II:All/E:Exploit/TD:Uncommon
Vulnerability: Third-party libraries
Description: The Drupal project uses the pear Archive_Tar library, which has released a security update that impacts Drupal.
For more information please see:

CVE-2020-36193
Exploits may be possible if Drupal is configured to allow .tar, .tar.gz, .bz2, or .tlz file uploads and processes them.
Click to expand...

Log in or Sign up

Drupal Releases Security Updates

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Drupal Releases Security Updates

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches