May 2017

LDAP - Critical - Data Injection

* Advisory ID: DRUPAL-SA-CONTRIB-2017-052
* Project: Lightweight Directory Access Protocol (LDAP) (third-party module)
* Version: 7.x
* Date: 2017-May-31
* Security risk: 15/25 ( Critical)
* Vulnerability: Multiple vulnerabilities

DESCRIPTION

The LDAP module does not sanitize user input correctly in several cases,
allowing a user to modify parameters without restriction and inject data.

Custom Landing Page Builder - Unsupported

* Advisory ID: DRUPAL-SA-CONTRIB-2017-050
* Project: landing_page (third-party module)
* Date: 24-May-2017

DESCRIPTION

The Custom Landing Page Builder module allows webmasters to build custom
landing pages using a WYSIWYG editor while still having full control over the
full layout of the page including the header, navigation, page content,
footer, forms etc.

Site Verify - Moderately Critical - Cross Site Scripting

* Advisory ID: DRUPAL-SA-CONTRIB-2017-051
* Project: Site verification (third-party module)
* Version: 7.x
* Date: 2017-May-24
* Security risk: 14/25 ( Moderately Critical)
* Vulnerability: Multiple vulnerabilities

DESCRIPTION

The Site Verify module enables privilege users to verify a site with services
like Google Webmaster Tools using meta tags or file uploads.

The module doesn't sufficiently sanitize input or restrict uploads.

Display Suite - Moderately Critical - Cross Site Scripting

* Advisory ID: DRUPAL-SA-CONTRIB-2017-049
* Project: Display Suite (third-party module)
* Version: 8.x
* Date: 2017-May-17
* Security risk: 13/25 ( Moderately Critical)
* Vulnerability: Cross Site Scripting

DESCRIPTION

Display Suite allows you to take full control over how your content is
displayed using a drag and drop interface.

Bootstrap - Critical - Information Disclosure

* Advisory ID: DRUPAL-SA-CONTRIB-2017-048
* Project: Bootstrap
* Date: 2017-May-17
* Security risk: 18/25 ( Critical)
* Vulnerability: Information Disclosure

DESCRIPTION

This theme enables you to bridge the gap between the Bootstrap Framework and
Drupal.

The theme does not sufficiently exclude the submitted password value when an
incorrect value has been submitted

VERSIONS AFFECTED

* bootstrap 8.x-3.x versions prior to 8.x-3.5.

DRD Agent - Critical - Multiple vulnerabilites

* Advisory ID: DRUPAL-SA-CONTRIB-2017-047
* Project: DRD agent (third-party module)
* Version: 6.x, 7.x, 8.x
* Date: 2017-May-10
* Security risk: 19/25 ( Critical)
* Vulnerability: Cross Site Request Forgery, Open Redirect

DESCRIPTION

The Drupal Remote Dashboard (DRD) module enables you to manage and monitor
any remote Drupal site and, this module, the DRD Agent is the remote module
which responds to requests from authorised DRD sites.

Drupal Remote Dashboard - Critical - Weak encryption keys

* Advisory ID: DRUPAL-SA-CONTRIB-2017-046
* Project: Drupal Remote Dashboard (third-party module)
* Version: 8.x
* Date: 2017-May-10
* Security risk: 17/25 ( Critical)
* Vulnerability: Access bypass, Information Disclosure

DESCRIPTION

This module enables you to remotely access remote Drupal sites to monitor and
manage them all from one central place.

Webform Multiple file upload - Moderately Critical - Access bypass

* Advisory ID: DRUPAL-SA-CONTRIB-2017-045
* Project: Webform Multiple File Upload (third-party module)
* Version: 7.x
* Date: 2017-May-10
* Security risk: 10/25 ( Moderately Critical)
* Vulnerability: Access bypass

DESCRIPTION

This module enables you to upload multiple files at once in a webform.
The module doesn't sufficiently check access to file deletion urls.
This vulnerability is mitigated by the fact that an attacker must have a role
with the permission to edit all or their own webform submissions.

Media - Moderately Critical - Multiple vulnerabilities

* Advisory ID: DRUPAL-SA-CONTRIB-2017-044
* Project: Media (third-party module)
* Version: 7.x
* Date: 2017-May-10
* Security risk: 16/25 ( Critical)
* Vulnerability: Information Disclosure, Arbitrary PHP code execution,
Multiple vulnerabilities

DESCRIPTION

This module provides intuitive ways to manage large libraries of media,
insert or display or import various types of media either through fields or a
wysiwyg interface.

shib_auth Moderately Critical - Multiple vulnerabilities

* Advisory ID: DRUPAL-SA-CONTRIB-2017-043
* Project: Shibboleth authentication
* Version: 7.x
* Date: 2017-May-03
* Security risk: 13/25 ( Moderately Critical)
* Vulnerability: Access bypass, Information Disclosure

DESCRIPTION

This module enables you to login via Shibboleth.

The module doesn't sufficiently logout the user when the shib session
expires, which depending on the caching mechanism makes private data public.