Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
110 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Access bypass vulnerability in Drupal Core allows JSON:API when JSON:API is in read/write mode. Only sites that have the readonly set to FALSE under jsonapi.settings config are vulnerable. This issue affects: Drupal Drupal Core 8.8.x versions prior to 8.8.8; 8.9.x versions prior to 8.9.1; 9.0.x versions prior to 9.0.1.
Recommended action: Upgrade to 9.0.1, 8.9.1 or 8.8.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Arbitrary PHP code execution vulnerability in Drupal Core under certain circumstances. An attacker could trick an administrator into visiting a malicious site that could result in creating a carefully named directory on the file system. With this directory in place, an attacker could attempt to brute force a remote code execution vulnerability. Windows servers are most likely to be affected. This issue affects: Drupal Drupal Core 8.8.x versions prior to 8.8.8; 8.9.x versions prior to 8.9.1; 9.0.1 versions prior to 9.0.1.
Recommended action: Upgrade to 9.0.1, 8.9.1 or 8.8.8 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Open Redirect vulnerability in Drupal Core allows a user to be tricked into visiting a specially crafted link which would redirect them to an arbitrary external URL. This issue affects: Drupal Drupal Core 7 version 7.70 and prior versions.
Recommended action: Upgrade to 7.70 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting vulnerability in Drupal Core. Drupal AJAX API does not disable JSONP by default, allowing for an XSS attack. This issue affects: Drupal Drupal Core 7.x versions prior to 7.73; 8.8.x versions prior to 8.8.10; 8.9.x versions prior to 8.9.6; 9.0.x versions prior to 9.0.6.
Recommended action: Upgrade to 9.0.6, 8.9.6, 8.8.10 or 7.73 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In Drupal 7 versions prior to 7.65; Drupal 8.6 versions prior to 8.6.13;Drupal 8.5 versions prior to 8.5.14. Under certain circumstances the File module/subsystem allows a malicious user to upload a file that can trigger a cross-site scripting (XSS) vulnerability.
Recommended action: Upgrade to 8.6.13, 8.5.14 or 7.65.0 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Drupal 7.x before 7.3 allows remote attackers to bypass intended nodeaccess restrictions via vectors related to a listing that shows nodes but lacks a JOIN clause for the node table.
Recommended action: Upgrade to 7.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Drupal 6.x before 6.38, 7.x before 7.43, and 8.x before 8.0.4 might allow remote attackers to conduct open redirect attacks by leveraging (1) custom code or (2) a form shown on a 404 error page, related to path manipulation.
Recommended action: Upgrade to 8.0.4, 7.43 or 6.38 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
CRLF injection vulnerability in the drupalsetheader function in Drupal 6.x before 6.38, when used with PHP before 5.1.2, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks by leveraging a module that allows user-submitted data to appear in HTTP headers.
Recommended action: Upgrade to 6.38 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The User module in Drupal 6.x before 6.38 and 7.x before 7.43 allows remote attackers to gain privileges by leveraging contributed or custom code that calls the usersave function with an explicit category and loads all roles into the array.
Recommended action: Upgrade to 7.43 or 6.38 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Form API in Drupal 6.x before 6.38 ignores access restrictions on submit buttons, which might allow remote attackers to bypass intended access restrictions by leveraging permission to submit a form with a button that has "#access" set to FALSE in the server-side form definition.
Recommended action: Upgrade to 6.38 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The System module in Drupal 6.x before 6.38 and 7.x before 7.43 might allow remote attackers to hijack the authentication of site administrators for requests that download and run files with arbitrary JSON-encoded content, aka a "reflected file download vulnerability."
Recommended action: Upgrade to 7.43 or 6.38 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The "have you forgotten your password" links in the User module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allow remote attackers to obtain sensitive username information by leveraging a configuration that permits using an email address to login and a module that permits logging in.
Recommended action: Upgrade to 8.0.4 or 7.43 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The XML-RPC system in Drupal 6.x before 6.38 and 7.x before 7.43 might make it easier for remote attackers to conduct brute-force attacks via a large number of calls made at once to the same method.
Recommended action: Upgrade to 7.43 or 6.38 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Open redirect vulnerability in the drupalgoto function in Drupal 6.x before 6.38, when used with PHP before 5.4.7, allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a double-encoded URL in the "destination" parameter.
Recommended action: Upgrade to 6.38 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The File module in Drupal 7.x before 7.43 and 8.x before 8.0.4 allows remote authenticated users to bypass access restrictions and read, delete, or substitute a link to a file uploaded to an unprocessed form by leveraging permission to create content or comment and upload files.
Recommended action: Upgrade to 8.0.4 or 7.43 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Drupal 6.x before 6.38, when used with PHP before 5.4.45, 5.5.x before 5.5.29, or 5.6.x before 5.6.13, might allow remote attackers to execute arbitrary code via vectors related to session data truncation.
Recommended action: Upgrade to 6.38 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Drupal 8.x before 8.1.10 does not properly check for "Administer comments" permission, which allows remote authenticated users to set the visibility of comments for arbitrary nodes by leveraging rights to edit those nodes.
Recommended action: Upgrade to 8.1.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting (XSS) vulnerability in Drupal 8.x before 8.1.10 allows remote attackers to inject arbitrary web script or HTML via vectors involving an HTTP exception.
Recommended action: Upgrade to 8.1.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The system.temporary route in Drupal 8.x before 8.1.10 does not properly check for "Export configuration" permission, which allows remote authenticated users to bypass intended access restrictions and read a full config export via unspecified vectors.
Recommended action: Upgrade to 8.1.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The User module in Drupal 7.x before 7.44 allows remote authenticated users to gain privileges via vectors involving contributed or custom code that triggers a rebuild of the user profile form.
Recommended action: Upgrade to 7.44 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Views module 7.x-3.x before 7.x-3.14 in Drupal 7.x and the Views module in Drupal 8.x before 8.1.3 might allow remote authenticated users to bypass intended access restrictions and obtain sensitive Statistics information via unspecified vectors.
Recommended action: Upgrade to 8.1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The transliterate mechanism in Drupal 8.x before 8.2.3 allows remote attackers to cause a denial of service via a crafted URL.
Recommended action: Upgrade to 8.2.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The user password reset form in Drupal 8.x before 8.2.3 allows remote attackers to conduct cache poisoning attacks by leveraging failure to specify a correct cache context.
Recommended action: Upgrade to 8.2.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Confirmation forms in Drupal 7.x before 7.52 make it easier for remote authenticated users to conduct open redirect attacks via unspecified vectors.
Recommended action: Upgrade to 8.2.3 or 7.52 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The taxonomy module in Drupal 7.x before 7.52 and 8.x before 8.2.3 might allow remote authenticated users to obtain sensitive information about taxonomy terms by leveraging inconsistent naming of access query tags.
Recommended action: Upgrade to 8.2.3 or 7.52 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.