Colorbox Node - Critical - Unsupported - SA-CONTRIB-2022-030
Project: Colorbox Node
Date: 2022-March-23
Security risk: Critical 15∕25
Vulnerability: UnsupportedThe AltaGrade Blog
Role Delegation - Moderately critical - Privilege escalation - SA-CONTRIB-2022-031
Project: Role Delegation
Date: 2022-March-23
Security risk: Moderately critical 14∕25
Vulnerability: Privilege escalationDescription
This module allows site administrators to grant specific roles the authority to assign selected roles to users, without them needing the administer permissions permission.
The module contains an access bypass vulnerability when used in combination with the Views Bulk Operations module. An authenticated user is able to assign the administrator role to his own user.
Drupal core - Moderately critical - Third-party libraries - SA-CORE-2022-006
Project: Drupal core
Date: 2022-March-21
Security risk: Moderately critical 11∕25
Vulnerability: Third-party libraries
CVE IDs: CVE-2022-24775Description
Drupal uses the third-party Guzzle library for handling HTTP requests and responses to external services. Guzzle has released a security update which may affect some Drupal sites.
Drupal core - Moderately critical - Third-party libraries - SA-CORE-2022-005
Project: Drupal core
Date: 2022-March-16
Security risk: Moderately critical 13∕25
Vulnerability: Third-party libraries
CVE IDs: CVE-2022-24728, CVE-2022-24729Description
The Drupal project uses the CKEditor library for WYSIWYG editing. CKEditor has released a security update that impacts Drupal.
WordPress 5.9.2 Security and Maintenance Release
WordPress 5.9.2 is now available!
This security and maintenance release features 1 bug fix in addition to 3 security fixes. Because this is a security release, it is recommended that you update your sites immediately. All versions since WordPress 3.7 have also been updated.
WordPress 5.9.2 is a security and maintenance release. The next major release will be version 6.0.
Opigno Learning path - Moderately critical - Access bypass - SA-CONTRIB-2022-029
Project: Opigno Learning path
Date: 2022-March-09
Security risk: Moderately critical 13∕25
Vulnerability: Access bypassDescription
This module is used as part of the Opigno LMS distribution and implements learning paths for the LMS.
The module was providing too much user information about users such as the list of groups a uid is in.
Solution
Install the latest version:
SVG Formatter - Critical - Cross Site Scripting - SA-CONTRIB-2022-028
Project: SVG Formatter
Date: 2022-March-09
Security risk: Critical 15∕25
Vulnerability: Cross Site ScriptingDescription
SVG Formatter module provides support for using SVG images on your website.
Our dependency library enshrined/svg-sanitize has a cross-site scripting vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with permission that enables them to upload SVG images.
GOV.UK Theme - Moderately critical - Cross site scripting - SA-CONTRIB-2022-027
Project: GOV.UK Theme
Date: 2022-February-23
Security risk: Moderately critical 14∕25
Vulnerability: Cross site scriptingDescription
The GOV.UK Theme (govuk_theme) is a Drupal theme for the GOV.UK Design System.
Entity Reference Tree Widget - Moderately critical - Cross Site Scripting - SA-CONTRIB-2022-026
Project: Entity Reference Tree Widget
Date: 2022-February-23
Security risk: Moderately critical 12∕25
Vulnerability: Cross Site ScriptingDescription
This module provides an entity relationship hierarchy tree widget for an entity reference field.
The module doesn't sufficiently filter on output, leading to a Cross Site Scripting vulnerability.
This vulnerability is mitigated by the fact that an attacker must have a role with the permission to modify an entity that is the reference to a field.
Quick Edit - Moderately critical - Information Disclosure - SA-CONTRIB-2022-025
Project: Quick Edit
Date: 2022-February-16
Security risk: Moderately critical 12∕25
Vulnerability: Information DisclosureDescription
This advisory addresses a similar issue to Drupal core - Moderately critical - Information disclosure - SA-CORE-2022-004.